ce6d6d004c3e114b63d132902e087abdd5688de6e6a48e5d034f19e9961cfc31

Analysis

user interaction
yes
max time kernel
151s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Octo_Browser_latest_win.exe
Size 47.2MB
Sample260920-28bpjsvtft
SHA256 ce6d6d004c3e114b63d132902e087abdd5688de6e6a48e5d034f19e9961cfc31
MD5 6c0eebdd831f069273800797cf51bfd7
SHA1 50a38e4978fd9942e26b716f541f6e0fe3733445
SHA512 accd958285079b10e74b3d542830c159c15dbe63b7dd7cef0d1fbf6ac5c16068fe1564b5441113b3e9aa4debb38c2aaf6c0daa26ea091fe390854c52516f43b1
SSDEEP 786432:N+ixyemZTKmA4RSiJvK2ywiqAKjqQqRJiLFEMqDcNIEsAsMxpttD7yBG/RDCDcpQ:Xxy59SiRFywSKZqRJiLuMq72pttD7y0m
TLSH
T1A2B73331368AC03BD6B305B2563CD6BE5538BEB51B2240EB63D47E6E99744C21732E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware trojan upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1704	powershell.exe
3860	powershell.exe
1312	powershell.exe
1616	powershell.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\L:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\W:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\S:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\L:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\Q:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\X:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\P:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\S:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\Z:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\O:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\A:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\T:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\V:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\G:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\Y:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\Z:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\M:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\O:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\I:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\B:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\D:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\X:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\K:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\V:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\H:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\N:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\D:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\H:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\P:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\M:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\J:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\R:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\U:	Octo_Browser_latest_win.exe
File opened (read-only)	\??\S:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
1892	MSI2E54.tmp

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000001cd39-1862.dat	upx
behavioral2/files/0x000700000001cd15-1863.dat	upx
behavioral2/memory/5836-3637-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp	upx
behavioral2/memory/5836-3639-0x00007FFD96580000-0x00007FFD9658F000-memory.dmp	upx
behavioral2/memory/5836-3638-0x00007FFD87750000-0x00007FFD87774000-memory.dmp	upx
behavioral2/memory/5836-3640-0x00007FFD90350000-0x00007FFD90368000-memory.dmp	upx
behavioral2/memory/5836-3641-0x00007FFD87720000-0x00007FFD8774D000-memory.dmp	upx
behavioral2/memory/5836-3642-0x00007FFD96570000-0x00007FFD9657D000-memory.dmp	upx
behavioral2/memory/5836-3643-0x00007FFD93360000-0x00007FFD9336D000-memory.dmp	upx
behavioral2/memory/5836-3644-0x00007FFD8E480000-0x00007FFD8E496000-memory.dmp	upx
behavioral2/memory/5836-3645-0x00007FFD7B230000-0x00007FFD7B80F000-memory.dmp	upx
behavioral2/memory/5836-3647-0x00007FFD8AF10000-0x00007FFD8AF29000-memory.dmp	upx
behavioral2/memory/5836-3646-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp	upx
behavioral2/memory/5836-3648-0x00007FFD92DD0000-0x00007FFD92DDD000-memory.dmp	upx
behavioral2/memory/5836-3650-0x00007FFD86FC0000-0x00007FFD86FF3000-memory.dmp	upx
behavioral2/memory/5836-3649-0x00007FFD87750000-0x00007FFD87774000-memory.dmp	upx
behavioral2/memory/5836-3651-0x00007FFD826D0000-0x00007FFD827C4000-memory.dmp	upx
behavioral2/memory/5836-3653-0x00007FFD91010000-0x00007FFD9101A000-memory.dmp	upx
behavioral2/memory/5836-3652-0x00007FFD86A00000-0x00007FFD86A35000-memory.dmp	upx
behavioral2/memory/5836-3654-0x00007FFD7F4B0000-0x00007FFD7F5CB000-memory.dmp	upx
behavioral2/memory/5836-3655-0x00007FFD870D0000-0x00007FFD870E6000-memory.dmp	upx
behavioral2/memory/5836-3657-0x00007FFD855F0000-0x00007FFD85602000-memory.dmp	upx
behavioral2/memory/5836-3656-0x00007FFD8E480000-0x00007FFD8E496000-memory.dmp	upx
behavioral2/memory/5836-3661-0x00007FFD92FA0000-0x00007FFD92FCE000-memory.dmp	upx
behavioral2/memory/5836-3662-0x00007FFD7F3F0000-0x00007FFD7F4AF000-memory.dmp	upx
behavioral2/memory/5836-3660-0x00007FFD7B230000-0x00007FFD7B80F000-memory.dmp	upx
behavioral2/memory/5836-3663-0x00007FFD92F70000-0x00007FFD92F9A000-memory.dmp	upx
behavioral2/memory/5836-3667-0x00007FFD96E20000-0x00007FFD96E2F000-memory.dmp	upx
behavioral2/memory/5836-3666-0x00007FFD86FC0000-0x00007FFD86FF3000-memory.dmp	upx
behavioral2/memory/5836-3682-0x00007FFD92F50000-0x00007FFD92F63000-memory.dmp	upx
behavioral2/memory/5836-3683-0x00007FFD91070000-0x00007FFD910A7000-memory.dmp	upx
behavioral2/memory/5836-3684-0x00007FFD91030000-0x00007FFD91066000-memory.dmp	upx
behavioral2/memory/5836-3685-0x00007FFD901D0000-0x00007FFD90205000-memory.dmp	upx
behavioral2/memory/5836-3686-0x00007FFD83760000-0x00007FFD837A4000-memory.dmp	upx
behavioral2/memory/5836-3687-0x00007FFD83720000-0x00007FFD83753000-memory.dmp	upx
behavioral2/memory/5836-3689-0x00007FFD82680000-0x00007FFD826CF000-memory.dmp	upx
behavioral2/memory/5836-3688-0x00007FFD92FA0000-0x00007FFD92FCE000-memory.dmp	upx
behavioral2/memory/5836-3691-0x00007FFD85570000-0x00007FFD85586000-memory.dmp	upx
behavioral2/memory/5836-3690-0x00007FFD7F3F0000-0x00007FFD7F4AF000-memory.dmp	upx
behavioral2/memory/5836-3693-0x00007FFD84E00000-0x00007FFD84E1B000-memory.dmp	upx
behavioral2/memory/5836-3697-0x00007FFD91070000-0x00007FFD910A7000-memory.dmp	upx
behavioral2/memory/5836-3696-0x00007FFD83090000-0x00007FFD830CE000-memory.dmp	upx
behavioral2/memory/5836-3695-0x00007FFD83AD0000-0x00007FFD83AE9000-memory.dmp	upx
behavioral2/memory/5836-3694-0x00007FFD84A60000-0x00007FFD84A84000-memory.dmp	upx
behavioral2/memory/5836-3692-0x00007FFD92F70000-0x00007FFD92F9A000-memory.dmp	upx
behavioral2/memory/5836-3698-0x00007FFD82630000-0x00007FFD82673000-memory.dmp	upx
behavioral2/memory/5836-3699-0x00007FFD7F3A0000-0x00007FFD7F3E4000-memory.dmp	upx
behavioral2/memory/5836-3700-0x00007FFD82E10000-0x00007FFD82E2D000-memory.dmp	upx
behavioral2/memory/5836-3701-0x00007FFD7F2D0000-0x00007FFD7F32D000-memory.dmp	upx
behavioral2/memory/5836-3702-0x00007FFD7EAF0000-0x00007FFD7EB51000-memory.dmp	upx
behavioral2/memory/5836-3703-0x00007FFD7EA80000-0x00007FFD7EAE1000-memory.dmp	upx
behavioral2/memory/5836-3704-0x00007FFD7F380000-0x00007FFD7F395000-memory.dmp	upx
behavioral2/memory/5836-3705-0x00007FFD7D9B0000-0x00007FFD7DA09000-memory.dmp	upx
behavioral2/memory/5836-3707-0x00007FFD7EA60000-0x00007FFD7EA79000-memory.dmp	upx
behavioral2/memory/5836-3706-0x00007FFD83090000-0x00007FFD830CE000-memory.dmp	upx
behavioral2/memory/5836-3708-0x00007FFD7E970000-0x00007FFD7E999000-memory.dmp	upx
behavioral2/memory/5836-3709-0x00007FFD7D970000-0x00007FFD7D9A3000-memory.dmp	upx
behavioral2/memory/5836-3710-0x00007FFD7D950000-0x00007FFD7D967000-memory.dmp	upx
behavioral2/memory/5836-3711-0x00007FFD7AA80000-0x00007FFD7B221000-memory.dmp	upx
behavioral2/memory/5836-3713-0x00007FFD7D910000-0x00007FFD7D948000-memory.dmp	upx
behavioral2/memory/5836-3712-0x00007FFD7F2D0000-0x00007FFD7F32D000-memory.dmp	upx
behavioral2/memory/5836-3715-0x00007FFD7EAF0000-0x00007FFD7EB51000-memory.dmp	upx
behavioral2/memory/5836-3716-0x00007FFD7D8F0000-0x00007FFD7D909000-memory.dmp	upx
behavioral2/memory/5836-3718-0x00007FFD7D840000-0x00007FFD7D88B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\ProfilesTagsFilterContainer-ClIDDyJG.css	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\PromoCodeModalForm-DqCLdNl8.js	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\ProxiesPage-CS042cAZ.css	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\subscription.plans.state-C1NSToes.js	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\md.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\mk.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\byn\LC_MESSAGES\iso3166-1.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\CounterWrap-B64316Ic.js	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\161-ivory-coast.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\200-south-africa.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\ky.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\be\LC_MESSAGES\iso15924.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\da\LC_MESSAGES\iso3166.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\zh_TW\LC_MESSAGES\iso3166.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\zu\LC_MESSAGES\iso3166.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\fr.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\bn_IN\LC_MESSAGES\iso3166.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\ca\LC_MESSAGES\iso639_3.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\fo\LC_MESSAGES\iso3166-1.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\sv\LC_MESSAGES\iso4217.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\dg.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\hn.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\sm.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\he\LC_MESSAGES\iso3166-1.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\sr\LC_MESSAGES\iso3166.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\sr\LC_MESSAGES\iso3166_2.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\th\LC_MESSAGES\iso3166.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\ChangeSubscriptionModal-KtsLii8N.js	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\ResourceLimitReachedModal-Cus3u85H.js	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\ax.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\br.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\octo_crypto-1.0.8.dist-info\INSTALLER	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\ast\LC_MESSAGES\iso15924.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\bg\LC_MESSAGES\iso639-3.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\MainProfileFormHeader-DPlbQPJH.js	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\template.schemas-B2iJwmg_.js	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\033-saint-kitts-and-nevis.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\217-virgin-islands.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\sb.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\tg.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\kab\LC_MESSAGES\iso639-5.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\pt_BR\LC_MESSAGES\iso639-3.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\Octo Browser.exe	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\profiles.filter.history.state--n1SKi7F.js	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\RefreshButton-5YWksfFM.css	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\142-tibet.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\hu.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\je.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\ar\LC_MESSAGES\iso639_3.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\hu\LC_MESSAGES\iso3166-1.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\aiohttp\_websocket\mask.cp312-win_amd64.pyd	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\assets\ProxyCheckInfo.module-CIFLyso6.js	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\locales\zh\translation.json	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\it\LC_MESSAGES\iso3166-1.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\mi\LC_MESSAGES\iso639-3.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\ms\LC_MESSAGES\iso639_3.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\sk\LC_MESSAGES\iso3166-2.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\pycountry\locales\sk\LC_MESSAGES\iso4217.mo	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\054-canary-islands.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\223-turks-and-caicos.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\pn.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\vg.svg	msiexec.exe
File created	C:\Program Files\Octo Browser\_internal\assets_new\app\images\flags\vi.svg	msiexec.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_1923358528\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e59d0d3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI453.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF819F4BF76F37D132.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF59B71D5C3DDC49C3.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_1923358528\protocols.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E14.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID480.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID51D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF251FF00D3FC533EE.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6FB7980A-B139-4245-A27C-62571DE941F5}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7DC156888A18BA3C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEDDA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{6FB7980A-B139-4245-A27C-62571DE941F5}\OctoBrowser.exe	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6000_1923358528\manifest.json	msedgewebview2.exe
File created	C:\Windows\Installer\e59d0d3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID3D3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF03C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID345.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE984.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5BC.tmp	msiexec.exe
File created	C:\Windows\Installer\{6FB7980A-B139-4245-A27C-62571DE941F5}\OctoBrowser.exe	msiexec.exe
File created	C:\Windows\Installer\e59d0d5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2DA6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2B7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID56C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID58C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E5.tmp	msiexec.exe

Executes dropped EXE 5 IoCs

pid	Process
1892	MSI2E54.tmp
5836	Octo Browser.exe
4420	Octo Browser.exe
3128	Octo Browser.exe
6084	Octo Browser.exe

Loads dropped DLL 64 IoCs

pid	Process
5484	Octo_Browser_latest_win.exe
5484	Octo_Browser_latest_win.exe
1112	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
5484	Octo_Browser_latest_win.exe
2572	MsiExec.exe
2572	MsiExec.exe
2572	MsiExec.exe
2572	MsiExec.exe
2572	MsiExec.exe
2572	MsiExec.exe
2572	MsiExec.exe
2572	MsiExec.exe
5484	Octo_Browser_latest_win.exe
2572	MsiExec.exe
2572	MsiExec.exe
5848	MsiExec.exe
2572	MsiExec.exe
5848	MsiExec.exe
2572	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
1112	MsiExec.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Octo Browser.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Octo_Browser_latest_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Octo_Browser_latest_win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI2E54.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 25 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\ProductIcon = "C:\\Windows\\Installer\\{6FB7980A-B139-4245-A27C-62571DE941F5}\\OctoBrowser.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A0897BF6931B54242AC72675D19E145F\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Blackbird Secure Browsing LTD\\Octo Browser 3.1.3\\install\\DE941F5\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Blackbird Secure Browsing LTD\\Octo Browser 3.1.3\\install\\DE941F5\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A0897BF6931B54242AC72675D19E145F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C807AA202B4F39E4999B8474C9A31903	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C807AA202B4F39E4999B8474C9A31903\A0897BF6931B54242AC72675D19E145F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A0897BF6931B54242AC72675D19E145F\C4FE6FD5B7C4D07B3A313E754A9A6A8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\ProductName = "Octo Browser"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\PackageCode = "40103C6CA67AA0540AA7260C959B7BA1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\Version = "50397187"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\SourceList\PackageName = "octo.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\Clients = 3a0000000000	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A0897BF6931B54242AC72675D19E145F\Language = "1033"	msiexec.exe

Modifies system certificate store 2 TTPs 7 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Octo_Browser_latest_win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 6b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Octo_Browser_latest_win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff16b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf69200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Octo_Browser_latest_win.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	Octo_Browser_latest_win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5900000001000000160000005200530041002f0053004800410033003800340000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b86b00000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df865c000000010000000400000000100000200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	Octo_Browser_latest_win.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	Octo_Browser_latest_win.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Octo_Browser_latest_win.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2572	MsiExec.exe
2572	MsiExec.exe
2572	MsiExec.exe
2572	MsiExec.exe
4364	msiexec.exe
4364	msiexec.exe
1704	powershell.exe
1704	powershell.exe
1704	powershell.exe
1312	powershell.exe
1312	powershell.exe
1312	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
3860	powershell.exe
3860	powershell.exe
3860	powershell.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
5836	Octo Browser.exe
4420	Octo Browser.exe
4420	Octo Browser.exe
4420	Octo Browser.exe
4420	Octo Browser.exe
3128	Octo Browser.exe
3128	Octo Browser.exe
3128	Octo Browser.exe
3128	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe
6084	Octo Browser.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6000	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4364	msiexec.exe
Token: SeCreateTokenPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeAssignPrimaryTokenPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeLockMemoryPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeIncreaseQuotaPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeMachineAccountPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeTcbPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeSecurityPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeTakeOwnershipPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeLoadDriverPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeSystemProfilePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeSystemtimePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeProfSingleProcessPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeIncBasePriorityPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeCreatePagefilePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeCreatePermanentPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeBackupPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeRestorePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeShutdownPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeDebugPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeAuditPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeSystemEnvironmentPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeChangeNotifyPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeRemoteShutdownPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeUndockPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeSyncAgentPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeEnableDelegationPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeManageVolumePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeImpersonatePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeCreateGlobalPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeCreateTokenPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeAssignPrimaryTokenPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeLockMemoryPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeIncreaseQuotaPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeMachineAccountPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeTcbPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeSecurityPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeTakeOwnershipPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeLoadDriverPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeSystemProfilePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeSystemtimePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeProfSingleProcessPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeIncBasePriorityPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeCreatePagefilePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeCreatePermanentPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeBackupPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeRestorePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeShutdownPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeDebugPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeAuditPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeSystemEnvironmentPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeChangeNotifyPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeRemoteShutdownPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeUndockPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeSyncAgentPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeEnableDelegationPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeManageVolumePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeImpersonatePrivilege	5484	Octo_Browser_latest_win.exe
Token: SeCreateGlobalPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeCreateTokenPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeAssignPrimaryTokenPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeLockMemoryPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeIncreaseQuotaPrivilege	5484	Octo_Browser_latest_win.exe
Token: SeMachineAccountPrivilege	5484	Octo_Browser_latest_win.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5484	Octo_Browser_latest_win.exe
5484	Octo_Browser_latest_win.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4364	msiexec.exe
1112	MsiExec.exe
2572	MsiExec.exe
5848	MsiExec.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 1112	4364	msiexec.exe	90
PID 5484 wrote to memory of 5740	5484	Octo_Browser_latest_win.exe	91
PID 4364 wrote to memory of 2572	4364	msiexec.exe	92
PID 4364 wrote to memory of 5848	4364	msiexec.exe	94
PID 4364 wrote to memory of 1892	4364	msiexec.exe	96
PID 1892 wrote to memory of 1704	1892	MSI2E54.tmp	97
PID 5836 wrote to memory of 1312	5836	Octo Browser.exe	102
PID 4420 wrote to memory of 1616	4420	Octo Browser.exe	106
PID 3128 wrote to memory of 3860	3128	Octo Browser.exe	108
PID 4420 wrote to memory of 6084	4420	Octo Browser.exe	110
PID 4420 wrote to memory of 6000	4420	Octo Browser.exe	111
PID 6000 wrote to memory of 1244	6000	msedgewebview2.exe	112
PID 6000 wrote to memory of 3844	6000	msedgewebview2.exe	113
PID 6000 wrote to memory of 3844	6000	msedgewebview2.exe	113
PID 6000 wrote to memory of 3844	6000	msedgewebview2.exe	113
PID 6000 wrote to memory of 3844	6000	msedgewebview2.exe	113
PID 6000 wrote to memory of 6080	6000	msedgewebview2.exe	114
PID 6000 wrote to memory of 1940	6000	msedgewebview2.exe	115
PID 6000 wrote to memory of 1940	6000	msedgewebview2.exe	115
PID 6000 wrote to memory of 1940	6000	msedgewebview2.exe	115
PID 6000 wrote to memory of 6020	6000	msedgewebview2.exe	116
PID 6000 wrote to memory of 6020	6000	msedgewebview2.exe	116
PID 6000 wrote to memory of 6020	6000	msedgewebview2.exe	116
PID 6000 wrote to memory of 6020	6000	msedgewebview2.exe	116
PID 6000 wrote to memory of 6020	6000	msedgewebview2.exe	116
PID 6000 wrote to memory of 2308	6000	msedgewebview2.exe	124
PID 6000 wrote to memory of 2308	6000	msedgewebview2.exe	124
PID 6000 wrote to memory of 2308	6000	msedgewebview2.exe	124

C:\Users\Admin\AppData\Local\Temp\Octo_Browser_latest_win.exe
"C:\Users\Admin\AppData\Local\Temp\Octo_Browser_latest_win.exe"
1⤵
- Enumerates connected drives
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Users\Admin\AppData\Local\Temp\Octo_Browser_latest_win.exe
  "C:\Users\Admin\AppData\Local\Temp\Octo_Browser_latest_win.exe" /i "C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\octo.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\Octo Browser" SECONDSEQUENCE="1" CLIENTPROCESSID="5484" CHAINERUIPROCESSID="5484Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature,C4FE6FD5B7C4D07B3A313E754A9A6A8" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" AI_PREREQDIRS="C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD" AI_FOUND_PREREQS=".NET Framework 4.8 (web installer)|Microsoft Edge WebView2|Visual C++ Redistributable for Visual Studio 2015-2019 x64" AI_DETECTED_ADMIN_USER="1" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Octo_Browser_latest_win.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1789705971 " TARGETDIR="F:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\Octo_Browser_latest_win.exe" AI_INSTALL="1"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:5740

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 465C36F127F72C830DC81BD874083B12 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1112
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 0C2FF820ADD6264620C6E67122D5A6C0
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2572
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6EB504A3099B1297C29B54EEEFAFE3C3 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5848
- C:\Windows\Installer\MSI2E54.tmp
  "C:\Windows\Installer\MSI2E54.tmp" /EnforcedRunAsAdmin /RunAsAdmin /HideWindow powershell.exe -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Octo Browser\bin' -Force"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Octo Browser\bin' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1704

C:\Program Files\Octo Browser\Octo Browser.exe
"C:\Program Files\Octo Browser\Octo Browser.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1312

C:\Program Files\Octo Browser\Octo Browser.exe
"C:\Program Files\Octo Browser\Octo Browser.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1616
- C:\Program Files\Octo Browser\Octo Browser.exe
  "C:\Program Files\Octo Browser\Octo Browser.exe" "--multiprocessing-fork" "parent_pid=4420" "pipe_handle=1044"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:6084
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Octo Browser.exe" --webview-exe-version=3.1.3 --user-data-dir="C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4420.4200.14216218069478564396 /pfhostedapp:3e27ff4c63fe581d50ac76b22c383619ac0db147
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView" /prefetch:4 /pfhostedapp:3e27ff4c63fe581d50ac76b22c383619ac0db147 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x180,0x184,0x188,0x15c,0x190,0x7ffd74dd5fd8,0x7ffd74dd5fe4,0x7ffd74dd5ff0
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView" --webview-exe-name="Octo Browser.exe" --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,1503388645244916483,10711839730946391706,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:3e27ff4c63fe581d50ac76b22c383619ac0db147
    3⤵
    PID:3844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView" --webview-exe-name="Octo Browser.exe" --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2052 --field-trial-handle=1772,i,1503388645244916483,10711839730946391706,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:3e27ff4c63fe581d50ac76b22c383619ac0db147
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView" --webview-exe-name="Octo Browser.exe" --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1772,i,1503388645244916483,10711839730946391706,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:3e27ff4c63fe581d50ac76b22c383619ac0db147
    3⤵
    PID:1940
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView" --webview-exe-name="Octo Browser.exe" --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1772,i,1503388645244916483,10711839730946391706,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:3e27ff4c63fe581d50ac76b22c383619ac0db147 /prefetch:1
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView" --webview-exe-name="Octo Browser.exe" --webview-exe-version=3.1.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4452 --field-trial-handle=1772,i,1503388645244916483,10711839730946391706,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:3e27ff4c63fe581d50ac76b22c383619ac0db147
    3⤵
    PID:2308

C:\Program Files\Octo Browser\Octo Browser.exe
"C:\Program Files\Octo Browser\Octo Browser.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59d0d4.rbs

Path C:\Config.Msi\e59d0d4.rbs
Size 3.2MB
SHA256 a2efe6ea556b49d67cf51c8d8cd9ebddfeeaa57c3e12fe14a0856f50b490f56e
MD5 1fa3f982591cca06176d8e78836f461b
SHA1 9f777188d2b732cda6851cb7557b4dfa29343b83
SHA512 327454652b0eb7791adbe2868352851144010d45f201454989b0545c56313c2bc60f2e047894f3403d3f21fb45ddf0cf1bbc5a82141682fda230032877b0a1a6
SSDEEP 49152:Rswu/SVANltKxaswu/SVANltKxeswu/SVANltKxiswu/SVANltKxhwXWjPSlUB+u:ywu/4wu/qwu/kwu/gB+nTC
TLSH
T1D6F58C31354AC136E47E11702A3C9E6E60697F620B7655DBA3CC4B7E59B09C2433AF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iso639-3.mo

Path C:\Program Files\Octo Browser\_internal\pycountry\locales\sv\LC_MESSAGES\iso639-3.mo
Size 395KB
SHA256 6870b898391c78424e231296289ddde9514dbd34190b42e30e70349d8f0cdc59
MD5 0c64ea81d5b251313dee5882d7816f30
SHA1 b3251f9e5e1812795c51ad9f2b30b3a8e2c9af6c
SHA512 f36d6be7e01c2559f7fbdeabe484f424b8ecdd90fcc12b119cd05420dbdfb1e1492ab6408a8f60ca63cb6a349b9ff3d0d857b9fea13e6c911e50c454df690c7c
SSDEEP 6144:8LrWB/RvVygSZFR6s1ComqVhx/KwOn6C9iwwKqz3Dgi4vPpNtED2jNX0rJcNmA1v:3cnF1/x5W3sDgigBPED2iA15+cuCr
TLSH
T137844972DD795E3CE67C063D5CB74A31834196CECD81CD0FA6A9FAA436832017A472B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_AE1E21D02DE89B3DAF834D52BF887DAF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_AE1E21D02DE89B3DAF834D52BF887DAF
Size 1KB
SHA256 18ce5f362f2f5f5325923f9945457422c598c46d970f2c97b1a5dc8f19beb020
MD5 1c628d40604c9800bf381786ffade463
SHA1 f5d3d0daa3668cfc072e31e3d92b990bea2f7e7d
SHA512 ca2457222fdf3c9d70f8359ad8ac675a87ab40098226389c6ec6de81889f383ea97d025251ae5dcbf2749095e0d121456857c8e0ce1abebf5351eea0526fba26
TLSH
T1C931D6830B2F349A77C68E351DC66E3B783885C119FC3426302B97823B157A71FD6828
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 81a94079ec5e486b20327ebfda81424fc56a5dc87296132abc2da5190ec6c4f0
MD5 9bbd8038a079cf7d767864ed8b1bc6df
SHA1 a0a84e6d2ad8734be86f513d0b69bd32581b6012
SHA512 67b9982d5abb818858001204d75d190fbcca285436c51aa64ace7d4f3c6c72b3f8de30238df6c8d4958cf81b6e9e1039a5e8426ca558ed5c2796bb2672672438
TLSH
T16831F82ECE7831C7AE50AC8D29DAF137ACB47B8458EA31416532440B11D07B32F46C8D
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_AE1E21D02DE89B3DAF834D52BF887DAF

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_AE1E21D02DE89B3DAF834D52BF887DAF
Size 536B
SHA256 24c77212f3332fb97093d4bb095ba99d859b360dba3a4181dc16044acdb69b77
MD5 bbe2c1ece1c4d4b2b6bd570ea6db6bb2
SHA1 4b7c7df16e5c3835f8b6c9eb5560d5f9e1ef7197
SHA512 a412c1da9251a0f6db621b3e9abb513f06726f4288c8c2f6746042771110121a728dcd9a7ae4a1a0af158bfb5f1e85590e762c30a1b4d2aea991a4b5100c20db
TLSH
T1C2F0D43815FB111EF037EE3507D0A595AC24F91738105A5A0EAE4309BD29F409E43E3A
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 3e060f8c3044eedf9c672037a065ee295ad05d3caaf620db57dc8ab16d3fb522
MD5 af290cc9facaae9403cb247dbef7fdbf
SHA1 64822fc156f5a40efd6dad9b194505753a458e69
SHA512 f3bba675b3c8d5ab31f70ade134839eb7dd6fca729d5bf52d5edc6cf8053d9388f7492f2f5f3258f674e9d8f6f3e8b3d2a711f537d5e0fed39434c83b3c7402e
TLSH
T1D5F0DC1801F5412EF073CB380FDDA596B929FD033C005BA40B664B0D1D267805DA683C
MD5 SHA1 SHA512 TLSH

Submit Download

bannerbitmap.jpg

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5484\bannerbitmap.jpg
Size 11KB
SHA256 6f4e87caa1d0039f7b146da2ad85ca065c034fa851278fb513f74f467d9a31c7
MD5 6faca2838c07fefd6da16ae908dc0c6a
SHA1 c398c82f2cd0bc6fc76ff7ea9504e96cf646dcf4
SHA512 c0945c53e0f5e2c2fa980795dba2b0914e71a6f1d93325fda9d1b78cbc315f11780bfe85e22e50911951a4fb9ee3b814bcd01595a04040c382de0e030fd1a11e
SSDEEP 192:nrqko3YGTx4woSW47J2LP0MYCVuCHn8WvDG0CQVjz4jvdDu1OzyKoYifk0:to3hTxfWg2YMjFRvv0Zu1Orsk0
TLSH
T118329F0E6FC7BE1341359E6951E86A263E5962371170C06C8022BECFFEDDC4AC97535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dialogbitmap.jpg

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5484\dialogbitmap.jpg
Size 48KB
SHA256 686004da6cdc1be243953d9899f2ea128a1d4bfacbfabdc2b57ba4e4ef11a811
MD5 b22f1fa41efe42638cd903d72755991b
SHA1 3099b15d72802f69ae9aa9cfbedb47b693cef74c
SHA512 dff731cd759ab127e0c035010f7a5d4a27902a48086bdc57a00abd93aeb189e8962a0059c84714b22ee803a06a79a607cc9130cc3fbdc372fd0088cf1666f0d9
SSDEEP 1536:hRjOF4JSNsLVJa1T8/M+ur7HWkmFE74+7Yod3c2i5v:rGWRkunur74M7vW2Uv
TLSH
T13A23583D03B5928EC4EF2D14C0366BE723776341C15F056AAA18D8D29BB3746B7A8D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8FC4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI8FC4.tmp
Size 391KB
SHA256 fcf24b9b574ed026d3f68b7b70aa6533806ba7fc566c476ccb62e6493ac28f04
MD5 a32decee57c661563b038d4f324e2b42
SHA1 3f381a7e31f450a40c8c2cf2c40c36a61fb7a4c2
SHA512 e17c125adad4702c9a30639858e22a2f0dc4f2926fca89758d544c62fe1fb95360dabd5bd2de2f62a607158bd9ef108c60d8cb5ce709c634668ee509988214f9
SSDEEP 6144:h95gAQAF0Zbd6hyEosZKE+JFiCnXxAO+VK7Gzds:hnQm0OAEosZr+KIoVLzds
TLSH
T1EF848C20B2D6C83BD17E45B03A6DD99F41297EA54BB2C4EBD3D81D2E05729C29235F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI90BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI90BF.tmp
Size 864KB
SHA256 98f4ebaa6ea1083e98ea0dd5c74c2cb22b1375c55b6a12cfdc5d877f716de392
MD5 4e2e67fc241ab6e440ad2789f705fc69
SHA1 bda5f46c1f51656d3cbad481fa2c76a553f03aba
SHA512 452df66dd2b09485bf92d92b72b3ad2638cbf0a570741b80309056d1e67e68a18cbd0ad3616a2943bb29de62a057848a7382b6c64c3821335a51b0a03131564c
SSDEEP 24576:Hg+hzcrwW9QZty0+0Flvz0jGGlQ3qDwFVpxGVlxmyMB:Awq9uty0+0F1z0jdlwqDwFVpxGVlxmyo
TLSH
T1EB15381E75DE8636FF7E9238AA68D73660F97FE10BB144EB53E0556A0E244C101B2F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI93E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI93E1.tmp
Size 569KB
SHA256 41abe8eb54a1910e6fc97fcea4de37a67058b7527badae8f39fba3788c46de14
MD5 0be7cdee6c5103c740539d18a94acbd0
SHA1 a364c342ff150f69b471b922c0d065630a0989bb
SHA512 f96ef5458fdc985501e0dca9cac3c912b3f2308be29eb8e6a305a3b02a3c61b129c4db2c98980b32fd01779566fa5173b2d841755d3cb30885e2f130e4ad6e2c
SSDEEP 12288:ExMVLwCHV6PNm0lA2QH3/ORiY/u1IOTyQtx7N6SfinDlVPJ81EPH7f:ExMtw+Hvu/bOJTUVPyqPH7f
TLSH
T105C44B20325AC43AE47D45B02A6CDB6E61697FB20B7A54DBA3C85A7F15F08C24731F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_le0w2qjx.pb5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_le0w2qjx.pb5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Octo Browser.exe

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\Octo Browser.exe
Size 10.0MB
SHA256 2d2a0867c817e15d094f94a746702377df0750bd7c2072e5a924bce1b5b46cc7
MD5 62bdfb4bff7c5325bb1a95179214a879
SHA1 4bd3a7ec61aad0d80b40e3bffe47b6395741599b
SHA512 2f6dec318d6f4b330009b4b84a57b2957a7532e432729804cc31c8641a6815c1e5ba4b4e3f9d06f7312ee747c1f82ec071c2cc4f524fd2cb87fa00aabaeac783
SSDEEP 196608:UzuoGViJowmtQX+FN97njv6bhqG9IgGyi0WzcIT:0bYizm6X+d3IhqNZkIT
TLSH
T1C7B623023EC205A7DBDEA7374162C538B576ADF63B65827F2E487776ED332802936121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_http_parser.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\aiohttp\_http_parser.cp312-win_amd64.pyd
Size 74KB
SHA256 2b4d6d8e3591efb2748307945c855291590c3767f11582529fe573353c09cb3d
MD5 b7b928fe57af3a7582a9d3b4165cb188
SHA1 79007e3895aca55695477d978442de773453286c
SHA512 e35ba183deaf1911a3bdc38b1b34be6d3ae26165176dca4b47fc0af1ec2932dafbfd663698b854d7eab1ddbf25574e6b21b83d2466df600f2acc66d01a2a46c0
SSDEEP 1536:rUyDSHLKaNGkcY6iPzb6DzW8ylEDquJEiWWAAQwJXSisXfREi3albgEM9xI:QyDSHe3kcYtrqW8FquJEdtHjP
TLSH
T1A47302EA9087B2ACCE8B6D326946A1CCF928D42371086BBD2194407F4CF3595573967B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mask.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\aiohttp\_websocket\mask.cp312-win_amd64.pyd
Size 20KB
SHA256 7c76132f1f047d5b8549fb8dd1ee3b9ec1d01eebb7de41883158e751e1b49fbc
MD5 cebceb0dc4689b15e601f5e63d747028
SHA1 84d7b2315fc63d052f2c646bcbe250532168cac0
SHA512 76a9ca853060c60dec23e6c2c5485f30800d7c99b0505a3fdb8812624afe361417adf226be295d3fcca6918602ba8fa827dcb63347cf689abb21be77b88927e2
SSDEEP 384:eFAOejbhyPWsf6xWh9RbOxTQuGQ19fO6A2G4J6L81eZa7gJXN6t:eFCbhSWY6oATzZ92bm6L8Mpd
TLSH
T14592B0931A6DE07CC4F2847686624954E321B92F619A5F0F84D832FBCDB5BE26D31722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-console-l1-1-0.dll
Size 22KB
SHA256 865bb0e7685cf0ce49dbd6394d0ef21fc2569b387d51b45d91b1a4667b1c4b38
MD5 1d577ef3d600ca6377c10f2699c3d560
SHA1 21d00982f757a27b972de40b4646cacdbd7c9b7b
SHA512 5e0234bf74e3db3f35f92440df6d6e743e2e28d1b1881b8ffbce4b216a1beb7c390f38c1e9e3ce50d4a3c9a96df061a4cf2614e0679f348f8bf3c8d72d4d19db
SSDEEP 192:yLOGW8hWClca8LxydkeR+nqMUGy/FqX01k9z3AqgDJmtG:yLNW8hWClcaGAiqM1rR9z56iG
TLSH
T1EDA24BC34FB8D042F9AB9DB05698DA537C3DBBC64980E46122D4F6182CE3395DB1872D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-datetime-l1-1-0.dll
Size 22KB
SHA256 4ace9b003aa7cac1c1191f40a06f21a2ce89bcf6f6e41bea52d86df08f3a44a7
MD5 1e5e2775d5f165a75b6274caa59cb2fa
SHA1 c43f88436a420049092ffd05bbcf10689517e9ec
SHA512 78a58429ed0a7ebbca1953636a1aa1325c13cc785638df8d991ecb9512303ce1eaaca9d7135e459a1aa8eb80a7973c2cc5407b2b0870743de6e1d9e31e64fe07
SSDEEP 192:uW8hWpca8LxydkeR+WW6xCGZBX01k9z3AyXHHgT:uW8hWpcaGAfBwGR9z/XgT
TLSH
T1D2A23AC25B7C9142FD9B6E7022A8EA537D3CA7DB1980D55211E5F0481CA37C5EB2473E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-debug-l1-1-0.dll
Size 22KB
SHA256 d8a30f95afb05b015f7c4069086c122586d001f8d457b9c3492e8fd5c14943c5
MD5 f2b5db8068fed78b32b4bf34197c040b
SHA1 757991b4b9e27bc3c1accacee13854e1d337689c
SHA512 a690d4d5f32f8026654b65fb8d7c4b054ea7c7d972518b29c0ede227393f3d4dd022f8c08fffe8a6da0c395ca727bf5445495ab838718a75c6bec37da14fc65a
SSDEEP 192:cW8hWnca8LxydkeR+EDPkyY8xYqD0cSX01k9z3AOcnrnP:cW8hWncaGAVzFvDyR9zLc7
TLSH
T184A23A864B7C9042FE9FAE7042A8EA837C7D77C74D90D9511698F5881CE37C6AB10A3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-errorhandling-l1-1-0.dll
Size 22KB
SHA256 17d40776e95eb614ef6e9a6f4d5021ecf1023fc7a053e7b6dd6cb978cfcf7fc3
MD5 408bdbbfbfbbcf3a356f226a4240b0cd
SHA1 4a86676b66bc0d41bd35139cd5dd744d10f7d9dc
SHA512 b0419ea7972b2eeb080f8e09f2c4b436ec240944ba2d4b0e95abe7ddb5d4c121c65d1f8d563c2ffa270c3fd6400a1913b54ceeec30b5a16948747e58e942aa79
SSDEEP 384:JL+eW8hWPcaGAf7pofRGTftGkeR9zxUSdWG4o:JL+8Gbde3kC9z2CZ4o
TLSH
T103A239D25B389043FDAB6E706395EE533C3D6BC71860A95255D4F0582CE37C9EB2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-fibers-l1-1-0.dll
Size 22KB
SHA256 15c1b7ff3e8b27909e764a4b2690bc2e47aea09be9384c239230daecc637d5ad
MD5 dae93411377d4b0e9efc45fc7d65771c
SHA1 5a2989df25dd95065be25ee99840d505addba6fb
SHA512 9c25ae758683e24d79ac2bd2f8004985e5cf5cc32e011ee908b55df5c5faffc8c429f2dcec7fb7c6479d6083a4c373852a4d4b5442b71f6194ee69939918a3fb
SSDEEP 192:+W8hWtzca8LxydkeR+1l/+TYekINFPKBWX01k9z3AKJ1lz8Kanp:+W8hW1caGAolf8KER9zRJ/8KM
TLSH
T193A228C257B89002ECAB6E7052A8E6537C3CBBD75D90C85526D5F1481CD33C9EB1467E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-file-l1-1-0.dll
Size 26KB
SHA256 7f31153a80b90785b71d23af9101220adc152ce5599b9842edc02cd2bb216a66
MD5 502718fd8ed13b8efd0313b2800a2d7d
SHA1 75479c923b032507f2c895c0c208011feb0aceb0
SHA512 edbd04622c66d4e2ba1f6bb1f0d6e0b4c40a82c17b066760ef6633f860a3840a3fb79e97fc706cf7b723c0fd0e6a7d5756bb4b4167c3cb07818d2a1278fdbaff
SSDEEP 384:jJPvVr2W8hWYcaGAf7pofcgO6HC3jIZR9z9x3:jJPvVrUnbderlC3jIT9zT
TLSH
T190C20983DA74F25BFC8F9E3151E2D983683943C7082095861BD4A75C3CE739BE2A8599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-file-l1-2-0.dll
Size 22KB
SHA256 07dc75d9f264e541b59e3aa65bfb6010b8ad47fbb613bd75884d2c70dc26ca79
MD5 b31dd16f46fbc03d678c0f270a0fb9dc
SHA1 2f92bf00865c79dcfdebe683b12965b491e327c0
SHA512 51581d1a5232f332f9f30e08b5429ca28c546264b4a1b5094a61b052dd3baae9808ca1e2f30a316fedd261eedfcb1b055b22bd3f5b4f50147f190cbb504a676b
SSDEEP 192:/E8iW8hWMzca8Lxyf7LRroihrS7JMD581BHX01k9z3AYuXuMO:/NiW8hW2caGAf7pof7JMFIBHR9zvuPO
TLSH
T16AA23BD283789102F99B6E7052F5DB637C3C67C71D90915226E5E0482CA37CEEA2972E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
TLSH
T16A9229D29BACD083F9677D7012D0D443BD3DA7D72550806A1AD8E6AD2C833C1EB14B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-handle-l1-1-0.dll
Size 22KB
SHA256 f5624bca5d977f47e40444cc88a6ff06ec3d8cf23aa982d6659abfd040debf67
MD5 d776e1f846c6d4441490fe08f8c6ef4e
SHA1 73377166f0603ebd52571c94a3d0a53f275fdfcc
SHA512 8887db83fd1b30658f060e719c01d780350114607dbfcbb23750bb41e520c4434c66c4cfad75faba31ef81773eb98002d98b53f25f42894923ce8a52df394cca
SSDEEP 384:4UW8hW/caGAf7pof0k3EQODtdQ5R9z/XnHZDM0:4qebde07QUds9z/5D5
TLSH
T110A24C92C77C9003FAAB6E709295DB537C3C6BCB0D60D5A216D8F14828A37D9DA2473D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-heap-l1-1-0.dll
Size 22KB
SHA256 1150af962aa00d3be9229940e73577fa1e36b42618f8b64e60023bf1577c87a6
MD5 d6fb459ce95a94217f70814beecfc3bf
SHA1 7bc1d162300a37ddeae83a01feae0e750af74ab6
SHA512 90738b27723e8ee743a95ea0ec497a0578f205d9280b9fd84b8b95f1e3c67e2bf4f6c301d19609c6ec012c824b842566c8618de17eb32d855b0ab4a82db61f96
SSDEEP 384:SexlFW8hW7caGAf7pofnrul8BR9zAsqKt:Xmbder19zP
TLSH
T15BA25BCA86689003FDAF6DB052A5DB537C3D67CB0820956319E8F04818E7B85EB35B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-interlocked-l1-1-0.dll
Size 22KB
SHA256 1d6a5be5c4d3ab9150bd4249ca853208ab7e83b63ecb9e773ba48a4ba1d0a24c
MD5 45a9df42de16cf04d447863d74f483a1
SHA1 a3db30c64bd802debc1db30c0b3104ebf574a170
SHA512 685060d857df6da88b6536aa3f1b2555d5efcb3469f39d16dc53f9d047afb355bbd2cf8ee47acd11bb7628228266e021d460041d88cb08ab5b3dec32355bdf68
SSDEEP 192:QxBW8hWYca8LxydkeR+GkjRmB8NunZMiuyCksX01k9z3AxKF:MW8hWYcaGALGk2NviCksR9zMKF
TLSH
T158A25DC68BBC9143FDAA6E7142A8EE837C3CB7CA5890C45116D5F25818E73C9E71463E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\api-ms-win-core-libraryloader-l1-1-0.dll
Size 22KB
SHA256 69f210f1423ce14a70ae2e41badb6eeb206cfa10624dad474492d268dff80e58
MD5 9f74fcede4235624377f35611e885e7a
SHA1 a73d0a2d1c9514bd5637877a1dea0539369827ad
SHA512 d9abbfbcdb55bd162aa51b18b2b83d34fa42fab8b6ae7813cf4b578c4d9ed7b665c75a8aadb77efb1da3a9e1a33c5d1cd4fea500981eb22e36c44e21c9e74f7b
SSDEEP 384:5TvuBL3BKW8hWCGcaGAsLywGOrjR9zEFHI:cBL3BgpSbCywGOrF9zGI
TLSH
T19BA22AC6967C9143FA9E9E305290EA433C3C77CB9890D86A42E5E6581CE3385FB1467E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\pycountry-22.3.5.dist-info\INSTALLER
Size 2B
SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
MD5 45210da832f9626829457a65e9e7c4d0
SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
MD5 SHA1 SHA512

Submit Download

iso3166_2.mo

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\_internal\pycountry\locales\id\LC_MESSAGES\iso3166_2.mo
Size 203KB
SHA256 fa0a3dc21d247ce400fb78e37c52e4081bada2507fdc9065070f1ba794400774
MD5 9103d3a90f7296a97dffeb14386708d2
SHA1 863fc31d194c3f76c96c66ff58043ab3b4e756a2
SHA512 81e5140f3ff2e0cf837aca97205ff4d122639721234144ca76e5318fc2772e14feadf011a228654981d82996bf8226fd796a7f63686b6025f2ca6a6444b66b18
SSDEEP 3072:+b9D2jraKH9qDQ2tXjg0PTrlVcOINrv1xG6eJiByhpdryN6l1Vi19jiCOh8Tx+:U9DAIc2BjgerlVcdSiB6pApiC280
TLSH
T14714292298B44E35D47C1E3D89E3612203B5EC86CB81CF276BBCB5716D936107D972BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

octo.msi

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\DE941F5\octo.msi
Size 4.9MB
SHA256 0875e94abd7e8e1773cffda31e2e0f56da0ba794e997ae01a0a742f1b4fc4ac5
MD5 020dc4e623e1323cff4e1c9e5f9e0ef1
SHA1 4972a607924390dc77b3655159335cd7af1ff975
SHA512 99a1a0aca1c8a2845024b324697b4faafb3f7627f80106993087d44e3155716dfed33ed670b93c213148f6561501977123fe1e09449d3195f166d4452e8340f4
SSDEEP 98304:KB+nTj3/3kFD9uq921z0pl/wu/CCxM1QOtCF1j:KgGDghSlnCCxM1C
TLSH
T18B368C2175D6C037EA7E52312A2DEB3A21797EF11B7240EB67D87E6E49B04C14271F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

decoder.dll

Path C:\Users\Admin\AppData\Roaming\Blackbird Secure Browsing LTD\Octo Browser 3.1.3\install\decoder.dll
Size 202KB
SHA256 e3404d4af16702a67dcaa4da4c5a8776ef350343b179ae6e7f2d347e7e1d1fb7
MD5 831e0b597db11a6eb6f3f797105f7be8
SHA1 d89154670218f9fba4515b0c1c634ae0900ca6d4
SHA512 e5e71a62c937e7d1c2cf7698bc80fa42732ddd82735ba0ccaee28aee7a7ea7b2132650dfd2c483eb6fb93f447b59643e1a3d6d077a50f0cd42b6f3fc78c1ad8f
SSDEEP 3072:IAksFo6EEhBlcN5wTRhwO2IDkzjWN4d0N1crZ91y5QH5BsUXbFXzAM9:IE6499KrdkcrZTbsUXbdsM9
TLSH
T1E8147C607683C97AE5AF1A305936EB7B122D77040F20D8DBB7981E3A5E790C25731C6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Roaming\Octo Browser\logs\debug.log
Size 5KB
SHA256 644d7169a7bb46f4803dac4c3d17b3e26e2371dbf3ed23585c7a64e8065b12ce
MD5 caac23ffae462c6624ba28dfacf3d5ef
SHA1 9e8e4ff269837156510aa912775cec259474f554
SHA512 befcd97754e6572a03537031d39162bddd635f30a578582f05aa0092064206a0fd2afca2737e6da51bdbe4b944b8623928cfb5143724f71cc96536c93ed0a2ba
SSDEEP 96:iCAorLWMLTLLtOlyPdnyLw7phzOyq4BWhFhehFhnGhLjzXRN4Ne+PZ+z+QzSyLd0:iCAS/vUlMFyAtWhFhehFhGhL4yRy4yC+
TLSH
T130B1203071F0583EC21A5246F9405AE853B332C7E61C65807F2D054DBC05BAEDAEEE75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.log

Path C:\Users\Admin\AppData\Roaming\Octo Browser\logs\debug.log
Size 5KB
SHA256 070bd5f58a6ee13a7441f1121322de200ea8d97246d1e27dfbb6b1e95f0db10b
MD5 f1582f11e5014accf20a7831c40be6bf
SHA1 fc6347b00fd3111b92123115744dca0581a124a6
SHA512 8b2ba442e67aa6fe04741ad913eab9fd933ab8f19869a178bc24c78498603fcfc94d38e2d4018fba9b9272bc7ef120fe766102566b5450b580fdde2dcba6c259
SSDEEP 96:iCAorLWMLTLLtOlyPdnyLw7phzOyq4BWhFhehFhnGhLjzXRN4Ne+PZ+z+QzSyLdp:iCAS/vUlMFyAtWhFhehFhGhL4yRy4yCP
TLSH
T179C1003071F05C3EC21A5246F9405AE8537732C7A51CA5807F2D154DBC0ABAED9EEE75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2cb5ffb908cf6bc2e60353d273ae9fae5d655c944f34722b101a82e2223f325c
MD5 a9977959557617b4ebc3737ef366be43
SHA1 403acfb86d69bcb137d420ffa6fffb33e6012dfb
SHA512 a064f3e1188be4d3ec91152ea5204cf75f0a988af01d1dc50aebf785a99ba1ac9cc6f7b1ad10b5ba675e400f5b9fe454252619882f879ba360d001a938399d36
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3997257f3067c33c0f84bea2a5d236136767a6c333194aec5bcadd13e3759989
MD5 48b93043370e3f749d556c7d5fe52144
SHA1 6c45ceef1205c1a2ff43d4d79a8c135f3ea7d213
SHA512 74dfd183801a88c679c441b46930b3a50dd6bb961c13b9c2d915699ed2c61bc010e5d7803984e6e8ed30b5d5039365465000e62ac57e5d5c663c18ba0d6d38fd
TLSH
T12CD0121232010134C01025730022B1088846D92F5105404094289D1E2A140500A02455
MD5 SHA1 SHA512 TLSH

Submit Download

7f9f74a6-1a45-4955-a9c1-305590540c85.tmp

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Default\7f9f74a6-1a45-4955-a9c1-305590540c85.tmp
Size 6KB
SHA256 69b93ce4c384d76bdc3650cc4f897e03ccb938d696a5ddc9ae3acd1e4c08742d
MD5 5fa428debcc0dda0ce02f67c33c73941
SHA1 968092d3fc66699a978299989ff7c0066710bdbc
SHA512 08c6ebc3759dc095a1268bc7cd1f5af21934584ca7ffe15982b6787512102a09f930314c66a5a3146c4d0b84ac074b3445706ac5de0292f29ca7593917d25c71
SSDEEP 96:st8Xd9wJUgb97kWo5h16ZJms7/x+6MhmuecDcS1ejeuK+g128XM1C7K:stID+/oymsV+FPcSQjGnG6K
TLSH
T131D195455E246D7B8CC6F509BA69BA13E2F9507260D11E59EBFC862C04EA6DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 960B
SHA256 cbdb40ec71ef7a9385579abdc0582bbb95ffc7e0a8d642ab6a4a4ef070c7c746
MD5 dbd30e1179999b3b8537728b745adda3
SHA1 7853f2062f849926937298e9c6bf97ee71a48766
SHA512 d35a5dc4435c7f8b7abd72faf2a049f429a8960596671d5d51c07d20e685c98a0aa1d550b1ce2fad04b175956abc41451904ff9445b9cd6a4b7d7fba47b316f9
TLSH
T122111C2947866485C36834B743F3969DBE33030CFD43AF878E97C1BD8654F85AA96C08
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b03e4.TMP

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5b03e4.TMP
Size 48B
SHA256 4f052bc8ccb6390962c6382761e278037aa914dc0c8997881675438a72456d99
MD5 55fea8d6e4a0a9e946a4cf056831a760
SHA1 e77efc5c09dfe306baf7fbec9d0f8d5cbdf8929d
SHA512 5342d2d8ce7bb5b51f746caad8375628930a721fed36583dea0af96e12cd1e14d567c380fa2d7ec864fb8ae79d788e18193245aa4b733349b284ee78f14ecee2
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Local State
Size 16KB
SHA256 c62393f72c1aec6d6ce6912f1d3635b72a66e5bb5122d11429eaed8198c71259
MD5 a4fbda758d9512aed6d09236e9330968
SHA1 c29f638a4c81d7f4aa640df9dc90ef4b085eec92
SHA512 ab79f904480b0968bd3dfd0a3a4bf203df657603bf6a40eb0a273bee4c99bff1de198d1896f069c167eaa276c791b617fdbae88333068b57991ff5533413638a
SSDEEP 384:N+aQikB+z/xvxjg/qhEwNBS65nWv+Fk9z3:Y/UxvxjgC+MK9F3
TLSH
T13B728D3F59652E27A5B3E9047D891B9BCBB898B294C26DB44AB84F0D07C72D80342816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Local State
Size 2KB
SHA256 d7936740f52f9fe1e1f41c977f717f0ef5c6e2fa49f221ad07d3fc0449d11fdf
MD5 cb395479edf6a3e5fe5355d0b178a90d
SHA1 d18bee16fe0e474a2ab81bc98a0faf00e85fbaf2
SHA512 89714edc82af8d0f8d937acd482ebe40bc6a87a430a987758b6b7cabce6fc36968b8b7cf609acf3b927d0a83a70f2046878f21ccda324ef97b4a725ca4dae0ec
TLSH
T1C051A6B7A8506F37C9A34609798A3F638E754165AAA22F50A9ED0B1C01CB55C2357C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Local State
Size 3KB
SHA256 e5766340cb61c1d67315cbc03325f7d9cc3c85b889ef81afa6f2cf2b35f4f8b3
MD5 f8c9a3a216298e07f95ab2d2cc2f659a
SHA1 9977701b86f933b419991c0adc3dd568dfbc1e03
SHA512 e34d43cca691891d389436074a91de3ad7f236b43b61aa8e93f7e846829e1974ed71804dd529d14af201b0444b48bed9e18c2c3e8ce940099bd0d39da0672130
TLSH
T1E571B5BB99A0AD378DA3990578C63F56ABA50127E5D17F95D5FC0F0C01C72882392C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5aaa5b.TMP

Path C:\Users\Admin\AppData\Roaming\Octo Browser\webviewengine\EBWebView\Local State~RFe5aaa5b.TMP
Size 1KB
SHA256 2480491943f3c29003006c33bb6de021872f5e8704c501cee323cd5c21471592
MD5 304085f1be8d277c20b082d61c602fc8
SHA1 230bad4755d24cee5b4a185d59ec88a7d77bae23
SHA512 b137787cdf9fcf5eef3c732e9c4a495d3b46cbbef188ab0a910b37409340f396faee0978e521d1b1c66b0a8aa758bbceeadb774e2b4c9734b6f3a5c3539a22f0
TLSH
T1873196FAD5E02F32DD52614631857FEB5F70016A92928E4074ED471D01DB54CA27FC3A
MD5 SHA1 SHA512 TLSH

Submit Download

MSI453.tmp

Path C:\Windows\Installer\MSI453.tmp
Size 674KB
SHA256 57ebe4a47b8abeb2a820b70425d933c0cd9eee3a2694fa937dcb7f71f862353b
MD5 2b2f5bd201e94e6581db48ee94ab88bf
SHA1 6809304d630bdabc4c684e20fd46f6fe2cbd65e6
SHA512 a2ddc11b2b48774e6a17385b22facd9c1721595b5146c64fec289d311fd6d25fce4e455f91b5979279662a3611ed7ea34b6ed2aa14f8746f71a42657d3feede8
SSDEEP 12288:mMojAdsv4WgOAsFwu4YZL//5yYAVN+NltKx:l5Wgswu/pAVN+NltKx
TLSH
T1D3E45B31354AC13AE57D4170253C9A7F60B93BB20B7254DBA7C85ABE58B49C24336F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-3670-0x0000019EF5900000-0x0000019EF5922000-memory.dmp

Download

memory/1312-3673-0x0000019EF5AE0000-0x0000019EF5AFE000-memory.dmp

Download

memory/1312-3679-0x0000019EF5980000-0x0000019EF5AAF000-memory.dmp

Download

memory/1312-3676-0x0000019EF6080000-0x0000019EF60AA000-memory.dmp

Download

memory/1312-3677-0x0000019EF6080000-0x0000019EF60A4000-memory.dmp

Download

memory/1312-3675-0x0000019EF5B00000-0x0000019EF5B0A000-memory.dmp

Download

memory/1312-3674-0x0000019EF5D40000-0x0000019EF5DF2000-memory.dmp

Download

memory/1704-3614-0x0000000006D40000-0x0000000006D60000-memory.dmp

Download

memory/1704-3609-0x0000000006790000-0x00000000067DC000-memory.dmp

Download

memory/1704-3600-0x0000000003260000-0x0000000003296000-memory.dmp

Download

memory/1704-3619-0x0000000007D30000-0x0000000007DC6000-memory.dmp

Download

memory/1704-3615-0x0000000007960000-0x0000000007A03000-memory.dmp

Download

memory/1704-3611-0x000000006E9F0000-0x000000006EA3C000-memory.dmp

Download

memory/1704-3610-0x0000000006D60000-0x0000000006D96000-memory.dmp

Download

memory/1704-3608-0x0000000006750000-0x000000000676E000-memory.dmp

Download

memory/1704-3616-0x0000000008100000-0x000000000877C000-memory.dmp

Download

memory/1704-3617-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

Download

memory/1704-3601-0x00000000059B0000-0x0000000005FFA000-memory.dmp

Download

memory/1704-3618-0x0000000007B30000-0x0000000007B3A000-memory.dmp

Download

memory/1704-3602-0x0000000006000000-0x0000000006022000-memory.dmp

Download

memory/1704-3603-0x0000000006190000-0x00000000061F6000-memory.dmp

Download

memory/1704-3604-0x0000000006270000-0x00000000062D6000-memory.dmp

Download

memory/1704-3607-0x00000000063F0000-0x000000000674B000-memory.dmp

Download

memory/2308-4856-0x00007FFD9D270000-0x00007FFD9D271000-memory.dmp

Download

memory/2308-4857-0x00007FFD9D530000-0x00007FFD9D531000-memory.dmp

Download

memory/3128-3965-0x000001B2FF140000-0x000001B2FF2CA000-memory.dmp

Download

memory/3844-4247-0x00007FFD9D430000-0x00007FFD9D431000-memory.dmp

Download

memory/3844-4480-0x000001DD05DB0000-0x000001DD05DB1000-memory.dmp

Download

memory/3844-4481-0x000001DD05DC0000-0x000001DD05DC2000-memory.dmp

Download

memory/3844-4483-0x000001DD05DD0000-0x000001DD05DD2000-memory.dmp

Download

memory/3844-4485-0x000001DD05E20000-0x000001DD05E23000-memory.dmp

Download

memory/3844-4486-0x000001DD05DB0000-0x000001DD05DB5000-memory.dmp

Download

memory/4420-4433-0x00007FFD96570000-0x00007FFD9657D000-memory.dmp

Download

memory/4420-4434-0x00007FFD93360000-0x00007FFD9336D000-memory.dmp

Download

memory/4420-4429-0x00007FFD87750000-0x00007FFD87774000-memory.dmp

Download

memory/4420-4454-0x00007FFD8F0E0000-0x00007FFD8F0EB000-memory.dmp

Download

memory/4420-4724-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/4420-4768-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/4420-4680-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/4420-4828-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/4420-4628-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/4420-4436-0x00007FFD7B230000-0x00007FFD7B80F000-memory.dmp

Download

memory/4420-4440-0x00007FFD826D0000-0x00007FFD827C4000-memory.dmp

Download

memory/4420-4428-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/4420-4452-0x00007FFD7D4A0000-0x00007FFD7D4BD000-memory.dmp

Download

memory/4420-4439-0x00007FFD86FC0000-0x00007FFD86FF3000-memory.dmp

Download

memory/4420-4576-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/4420-4453-0x00007FFD7CFE0000-0x00007FFD7CFF3000-memory.dmp

Download

memory/4420-4444-0x00007FFD870D0000-0x00007FFD870E6000-memory.dmp

Download

memory/4420-4529-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/5836-3638-0x00007FFD87750000-0x00007FFD87774000-memory.dmp

Download

memory/5836-3687-0x00007FFD83720000-0x00007FFD83753000-memory.dmp

Download

memory/5836-3702-0x00007FFD7EAF0000-0x00007FFD7EB51000-memory.dmp

Download

memory/5836-3703-0x00007FFD7EA80000-0x00007FFD7EAE1000-memory.dmp

Download

memory/5836-3704-0x00007FFD7F380000-0x00007FFD7F395000-memory.dmp

Download

memory/5836-3705-0x00007FFD7D9B0000-0x00007FFD7DA09000-memory.dmp

Download

memory/5836-3707-0x00007FFD7EA60000-0x00007FFD7EA79000-memory.dmp

Download

memory/5836-3706-0x00007FFD83090000-0x00007FFD830CE000-memory.dmp

Download

memory/5836-3708-0x00007FFD7E970000-0x00007FFD7E999000-memory.dmp

Download

memory/5836-3709-0x00007FFD7D970000-0x00007FFD7D9A3000-memory.dmp

Download

memory/5836-3710-0x00007FFD7D950000-0x00007FFD7D967000-memory.dmp

Download

memory/5836-3711-0x00007FFD7AA80000-0x00007FFD7B221000-memory.dmp

Download

memory/5836-3713-0x00007FFD7D910000-0x00007FFD7D948000-memory.dmp

Download

memory/5836-3712-0x00007FFD7F2D0000-0x00007FFD7F32D000-memory.dmp

Download

memory/5836-3715-0x00007FFD7EAF0000-0x00007FFD7EB51000-memory.dmp

Download

memory/5836-3716-0x00007FFD7D8F0000-0x00007FFD7D909000-memory.dmp

Download

memory/5836-3718-0x00007FFD7D840000-0x00007FFD7D88B000-memory.dmp

Download

memory/5836-3717-0x00007FFD7EA80000-0x00007FFD7EAE1000-memory.dmp

Download

memory/5836-3719-0x00007FFD96E10000-0x00007FFD96E1D000-memory.dmp

Download

memory/5836-3723-0x00007FFD7D800000-0x00007FFD7D81F000-memory.dmp

Download

memory/5836-3722-0x00007FFD7EA60000-0x00007FFD7EA79000-memory.dmp

Download

memory/5836-3721-0x00007FFD7D820000-0x00007FFD7D83C000-memory.dmp

Download

memory/5836-3725-0x00007FFD7D7E0000-0x00007FFD7D7F9000-memory.dmp

Download

memory/5836-3724-0x00007FFD7E970000-0x00007FFD7E999000-memory.dmp

Download

memory/5836-3720-0x00007FFD7D9B0000-0x00007FFD7DA09000-memory.dmp

Download

memory/5836-3726-0x00007FFD7D7C0000-0x00007FFD7D7D4000-memory.dmp

Download

memory/5836-3728-0x00007FFD7D770000-0x00007FFD7D7B8000-memory.dmp

Download

memory/5836-3727-0x00007FFD7AA80000-0x00007FFD7B221000-memory.dmp

Download

memory/5836-3729-0x00007FFD7D750000-0x00007FFD7D761000-memory.dmp

Download

memory/5836-3700-0x00007FFD82E10000-0x00007FFD82E2D000-memory.dmp

Download

memory/5836-3699-0x00007FFD7F3A0000-0x00007FFD7F3E4000-memory.dmp

Download

memory/5836-3698-0x00007FFD82630000-0x00007FFD82673000-memory.dmp

Download

memory/5836-4076-0x00007FFD86FC0000-0x00007FFD86FF3000-memory.dmp

Download

memory/5836-4071-0x00007FFD93360000-0x00007FFD9336D000-memory.dmp

Download

memory/5836-4066-0x00007FFD87750000-0x00007FFD87774000-memory.dmp

Download

memory/5836-4065-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/5836-4077-0x00007FFD826D0000-0x00007FFD827C4000-memory.dmp

Download

memory/5836-4073-0x00007FFD7B230000-0x00007FFD7B80F000-memory.dmp

Download

memory/5836-4104-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/5836-3692-0x00007FFD92F70000-0x00007FFD92F9A000-memory.dmp

Download

memory/5836-3694-0x00007FFD84A60000-0x00007FFD84A84000-memory.dmp

Download

memory/5836-3695-0x00007FFD83AD0000-0x00007FFD83AE9000-memory.dmp

Download

memory/5836-3696-0x00007FFD83090000-0x00007FFD830CE000-memory.dmp

Download

memory/5836-3697-0x00007FFD91070000-0x00007FFD910A7000-memory.dmp

Download

memory/5836-3693-0x00007FFD84E00000-0x00007FFD84E1B000-memory.dmp

Download

memory/5836-3690-0x00007FFD7F3F0000-0x00007FFD7F4AF000-memory.dmp

Download

memory/5836-3691-0x00007FFD85570000-0x00007FFD85586000-memory.dmp

Download

memory/5836-3688-0x00007FFD92FA0000-0x00007FFD92FCE000-memory.dmp

Download

memory/5836-3689-0x00007FFD82680000-0x00007FFD826CF000-memory.dmp

Download

memory/5836-3701-0x00007FFD7F2D0000-0x00007FFD7F32D000-memory.dmp

Download

memory/5836-3686-0x00007FFD83760000-0x00007FFD837A4000-memory.dmp

Download

memory/5836-3685-0x00007FFD901D0000-0x00007FFD90205000-memory.dmp

Download

memory/5836-3684-0x00007FFD91030000-0x00007FFD91066000-memory.dmp

Download

memory/5836-3683-0x00007FFD91070000-0x00007FFD910A7000-memory.dmp

Download

memory/5836-3682-0x00007FFD92F50000-0x00007FFD92F63000-memory.dmp

Download

memory/5836-3666-0x00007FFD86FC0000-0x00007FFD86FF3000-memory.dmp

Download

memory/5836-3667-0x00007FFD96E20000-0x00007FFD96E2F000-memory.dmp

Download

memory/5836-3663-0x00007FFD92F70000-0x00007FFD92F9A000-memory.dmp

Download

memory/5836-3660-0x00007FFD7B230000-0x00007FFD7B80F000-memory.dmp

Download

memory/5836-3662-0x00007FFD7F3F0000-0x00007FFD7F4AF000-memory.dmp

Download

memory/5836-3661-0x00007FFD92FA0000-0x00007FFD92FCE000-memory.dmp

Download

memory/5836-3656-0x00007FFD8E480000-0x00007FFD8E496000-memory.dmp

Download

memory/5836-3657-0x00007FFD855F0000-0x00007FFD85602000-memory.dmp

Download

memory/5836-3655-0x00007FFD870D0000-0x00007FFD870E6000-memory.dmp

Download

memory/5836-3654-0x00007FFD7F4B0000-0x00007FFD7F5CB000-memory.dmp

Download

memory/5836-3652-0x00007FFD86A00000-0x00007FFD86A35000-memory.dmp

Download

memory/5836-3653-0x00007FFD91010000-0x00007FFD9101A000-memory.dmp

Download

memory/5836-3651-0x00007FFD826D0000-0x00007FFD827C4000-memory.dmp

Download

memory/5836-3649-0x00007FFD87750000-0x00007FFD87774000-memory.dmp

Download

memory/5836-3650-0x00007FFD86FC0000-0x00007FFD86FF3000-memory.dmp

Download

memory/5836-3648-0x00007FFD92DD0000-0x00007FFD92DDD000-memory.dmp

Download

memory/5836-3646-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/5836-3637-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/5836-3639-0x00007FFD96580000-0x00007FFD9658F000-memory.dmp

Download

memory/5836-3640-0x00007FFD90350000-0x00007FFD90368000-memory.dmp

Download

memory/5836-3641-0x00007FFD87720000-0x00007FFD8774D000-memory.dmp

Download

memory/5836-3642-0x00007FFD96570000-0x00007FFD9657D000-memory.dmp

Download

memory/5836-3643-0x00007FFD93360000-0x00007FFD9336D000-memory.dmp

Download

memory/5836-3644-0x00007FFD8E480000-0x00007FFD8E496000-memory.dmp

Download

memory/5836-3645-0x00007FFD7B230000-0x00007FFD7B80F000-memory.dmp

Download

memory/5836-3647-0x00007FFD8AF10000-0x00007FFD8AF29000-memory.dmp

Download

memory/6020-4322-0x00007FFD9D430000-0x00007FFD9D431000-memory.dmp

Download

memory/6084-4506-0x00007FFD7D8F0000-0x00007FFD7D909000-memory.dmp

Download

memory/6084-4505-0x00007FFD7F4B0000-0x00007FFD7F5CB000-memory.dmp

Download

memory/6084-4494-0x00007FFD87720000-0x00007FFD8774D000-memory.dmp

Download

memory/6084-4493-0x00007FFD90350000-0x00007FFD90368000-memory.dmp

Download

memory/6084-4500-0x00007FFD92DD0000-0x00007FFD92DDD000-memory.dmp

Download

memory/6084-4501-0x00007FFD86FC0000-0x00007FFD86FF3000-memory.dmp

Download

memory/6084-4502-0x00007FFD826D0000-0x00007FFD827C4000-memory.dmp

Download

memory/6084-4499-0x00007FFD8AF10000-0x00007FFD8AF29000-memory.dmp

Download

memory/6084-4495-0x00007FFD96570000-0x00007FFD9657D000-memory.dmp

Download

memory/6084-4490-0x00007FFD7B810000-0x00007FFD7BECA000-memory.dmp

Download

memory/6084-4498-0x00007FFD7B230000-0x00007FFD7B80F000-memory.dmp

Download

memory/6084-4497-0x00007FFD8E480000-0x00007FFD8E496000-memory.dmp

Download

memory/6084-4496-0x00007FFD93360000-0x00007FFD9336D000-memory.dmp

Download

memory/6084-4492-0x00007FFD96580000-0x00007FFD9658F000-memory.dmp

Download

memory/6084-4491-0x00007FFD87750000-0x00007FFD87774000-memory.dmp

Download

memory/6084-4504-0x00007FFD91010000-0x00007FFD9101A000-memory.dmp

Download

memory/6084-4503-0x00007FFD86A00000-0x00007FFD86A35000-memory.dmp

Download