06c734d9bd36ecc60a7263c04454164f3160fa64cfd8c140dd8f69bd1ddb34a8

Analysis

max time kernel
60s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/09/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fluxus.exe
Size 3.0MB
Sample260920-ycppra1vcy
SHA256 06c734d9bd36ecc60a7263c04454164f3160fa64cfd8c140dd8f69bd1ddb34a8
MD5 21aa6a34ad905761dc17cb11252e3047
SHA1 3c31e90cf923deb37648baccd94e2829c0582e66
SHA512 2df123f1d27b98e192e21feb7a025275c092a33c37263d54675f322e9c8d49df2b7ffd2427ac3e4ad1b1634ef4bbcea029c461203daf73faac72f13d9aac2de1
SSDEEP 49152:6uDdgW9a0cyKWfZL7vDsZssO+QhuhF8Pikv2WNTUCPvGzOsBCpz63ck0HrSWB:PZgjyKWBnvYQI8Pikv5TrPvnsBM6sr
TLSH
T175E52265E7D824F9E1739678DA739502DA72BC1B0B70C9CF07A459060E37AD0993AF32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery persistence ransomware

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4644 created 3272	4644	Fluxus.exe	56
PID 4644 created 3272	4644	Fluxus.exe	56

Loads dropped DLL 2 IoCs

pid	Process
2864	chrome.exe
4420	msedge.exe

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	msedge.exe
Key opened	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	chrome.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	chrome.exe
Key opened	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3464	chrome.exe
2620	msedge.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134344067428864526"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{D1A1F88B-0138-493E-979D-8418442EEBDC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4644	Fluxus.exe
4644	Fluxus.exe
4644	Fluxus.exe
4644	Fluxus.exe
4644	Fluxus.exe
4644	Fluxus.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
2864	chrome.exe
4644	Fluxus.exe
4644	Fluxus.exe
4644	Fluxus.exe
4644	Fluxus.exe
4644	Fluxus.exe
4644	Fluxus.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeDebugPrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe
Token: SeCreatePagefilePrivilege	2864	chrome.exe
Token: SeShutdownPrivilege	2864	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2864	chrome.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2864	4644	Fluxus.exe	88
PID 2864 wrote to memory of 1216	2864	chrome.exe	89
PID 4644 wrote to memory of 2864	4644	Fluxus.exe	88
PID 4644 wrote to memory of 2864	4644	Fluxus.exe	88
PID 4644 wrote to memory of 2864	4644	Fluxus.exe	88
PID 2864 wrote to memory of 3356	2864	chrome.exe	92
PID 2864 wrote to memory of 3464	2864	chrome.exe	93
PID 2864 wrote to memory of 1248	2864	chrome.exe	94
PID 2864 wrote to memory of 1948	2864	chrome.exe	95
PID 2864 wrote to memory of 2840	2864	chrome.exe	96
PID 2864 wrote to memory of 2012	2864	chrome.exe	130
PID 4644 wrote to memory of 4420	4644	Fluxus.exe	138
PID 4644 wrote to memory of 4420	4644	Fluxus.exe	138
PID 4644 wrote to memory of 4420	4644	Fluxus.exe	138
PID 4644 wrote to memory of 4420	4644	Fluxus.exe	138
PID 4420 wrote to memory of 896	4420	msedge.exe	139
PID 4420 wrote to memory of 2372	4420	msedge.exe	142
PID 4420 wrote to memory of 2620	4420	msedge.exe	143
PID 4420 wrote to memory of 848	4420	msedge.exe	144
PID 4420 wrote to memory of 2944	4420	msedge.exe	146
PID 4420 wrote to memory of 4528	4420	msedge.exe	147
PID 4420 wrote to memory of 5464	4420	msedge.exe	148
PID 4420 wrote to memory of 5472	4420	msedge.exe	149
PID 4420 wrote to memory of 5228	4420	msedge.exe	153
PID 4420 wrote to memory of 5312	4420	msedge.exe	154
PID 4420 wrote to memory of 6148	4420	msedge.exe	157
PID 2864 wrote to memory of 6988	2864	chrome.exe	163
PID 2864 wrote to memory of 6996	2864	chrome.exe	164
PID 2864 wrote to memory of 7004	2864	chrome.exe	165
PID 4420 wrote to memory of 5528	4420	msedge.exe	166
PID 4420 wrote to memory of 5516	4420	msedge.exe	167
PID 4420 wrote to memory of 5256	4420	msedge.exe	168
PID 4420 wrote to memory of 6056	4420	msedge.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	msedge.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3272
- C:\Users\Admin\AppData\Local\Temp\Fluxus.exe
  "C:\Users\Admin\AppData\Local\Temp\Fluxus.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --window-position=-32000,-32000 --disable-features=RendererCodeIntegrity,DynamicCodeSettings --no-sandbox
  2⤵
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff96152c728,0x7ff96152c734,0x7ff96152c740
    3⤵
    PID:1216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,9139560155727648226,2490101936005722175,262144 --field-trial-handle=2160,i,14161912460513577312,6173345460066744214,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:3356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1624,i,5868898560705777686,1091269603357715437,524288 --field-trial-handle=2160,i,14161912460513577312,6173345460066744214,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,6815330216304931837,3003151758707960275,524288 --field-trial-handle=2160,i,14161912460513577312,6173345460066744214,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2492 /prefetch:8
    3⤵
    PID:1248
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3032,i,3090445999344773957,13088209212092698766,2097152 --field-trial-handle=2160,i,14161912460513577312,6173345460066744214,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3104 /prefetch:1
    3⤵
    PID:1948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3048,i,1579559581632411603,1515748284958628983,2097152 --field-trial-handle=2160,i,14161912460513577312,6173345460066744214,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3108 /prefetch:1
    3⤵
    PID:2840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4248,i,10017892357332452036,715657748614867631,2097152 --field-trial-handle=2160,i,14161912460513577312,6173345460066744214,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1144,i,1801953156804425413,17051009775486705885,524288 --field-trial-handle=2160,i,14161912460513577312,6173345460066744214,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1164 /prefetch:8
    3⤵
    PID:6988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1048,i,3917162307848744082,8453522576604084333,524288 --field-trial-handle=2160,i,14161912460513577312,6173345460066744214,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    PID:6996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1156,i,18387896261053860163,4982218922351612459,524288 --field-trial-handle=2160,i,14161912460513577312,6173345460066744214,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4972 /prefetch:8
    3⤵
    PID:7004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --window-position=-32000,-32000 --disable-features=RendererCodeIntegrity,DynamicCodeSettings --no-sandbox
  2⤵
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2bc,0x7ff94efbc188,0x7ff94efbc194,0x7ff94efbc1a0
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,8507713535712846239,8265153576981357707,262144 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:2
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,7178471965352634172,9227869397701192106,524288 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,15120171111925829423,7622315370272075596,524288 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:8
    3⤵
    PID:848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3264,i,13350056166098972203,4072572534720327630,2097152 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3268,i,1874075427974339795,14144245876704916156,2097152 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3788,i,1920350006667836652,14590477464427210577,2097152 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3824,i,7559801794714409471,12480669187994247331,2097152 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:2
    3⤵
    PID:5472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,13672741146062984706,12276491912339902536,524288 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,14466552449239301314,13230894554109258600,524288 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6358129724092901463,4952863919466847369,524288 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6358129724092901463,4952863919466847369,524288 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:6148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,6079737610547947004,17546802324661219352,524288 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,4809159347862642394,8726393591838031041,524288 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
    3⤵
    PID:5516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,10343518310940433759,9966421930145103044,524288 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,15188771219332894457,2403130698081205862,524288 --field-trial-handle=3036,i,1833616510885416556,1976479485900733857,262144 --disable-features=DynamicCodeSettings,RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:6056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2504

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4324

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4360

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2620

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2732

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1672

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4268

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 6abe61b887ade112e8957ce0913ed85a7e513cdf7f5cbcf085c756424402fb40
MD5 cd32ca51e1feb0e6acfb15801bfb8073
SHA1 52b4240950d8c14e1ebb9a6197a6ab746c647847
SHA512 8f522aeca32d0fcfc33e2506fe90d9b59848f670573935809a282d05c161e88280c13a910e2445be8d4bb5ed78bae4c9c0dc5149bdebf97d1cfa689be0acb5a8
SSDEEP 192:8RYOcw86dv7UpAPRp2v9/Hsb+WNnMY0osJykkwZhVyIsnAUge:8RvcUdAUXchw30zJL5He
TLSH
T1C332942DED14753B5CDBC22AEA267B57D7F6102160942E84E6FC8D3C2AD7ACC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 830cb02cc8041d27d283751486aa0b5d3bd13b6735115db6a7d79d0833d4935f
MD5 60da535d3d4687961906e2d735debb8a
SHA1 954dee145e2548392bcd4b232ab634be58f4eb14
SHA512 5b80aeb1b9ee72bb083de67214127602edc24a6aa9b94f8791f942efe578a8fd973a8aaeb4d8a260bb5084754f4f285bdcd05812bd3008e421db07f7ad54b24e
SSDEEP 192:8R7cw86dv7UpAPRp2v9/Hsb+WNnMY0osJykkwZhVyIsnAUge:8R7cUdAUXchw30zJL5He
TLSH
T14F32942DAD14753B9CDBC22AFA267B57D7F6102160942E84E6FC8D3C2AE79CC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 2c8a7f1683e108be85e6cd019b6be9bba35620ac02740dffa9fdbb92bcf24e21
MD5 6a461117dbc6670d37efe686a509e8aa
SHA1 77a3f63ffb2766f12adfabf03e44a8944031f518
SHA512 b0a465a0c5e4b536a1f1c8c86f9d9a5e3ad24f9d6aa0f875303f397187423c546053f6eb6846bcfac898dfbe84c229b95bd9adb95542f978660aa3c4e454bb70
SSDEEP 192:eV24K6lN7KxkXqK4I40pUZNCgVLHrKHfFKslEat/XzKD/+N+ErUkKNJWTGxIkHYd:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/p
TLSH
T12E32EA27A88D9A7F4FE8D509CC136F4BADF1025662780D2492FF9D0903A578A114E6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 8434d10f1feb51cc9c5f137e127b2a97c71a42d7dbc082c219f7113b32d8681c
MD5 0cecda4cf9eeed4b091acda1abbbaab5
SHA1 2f90f07927a3f51c25d0a7dc94ba80d1b7bc9aa1
SHA512 122ad2d33a1c0d7aa83ecdbff4f91781ec7483dc9cc623bb156f15f532b6277cc50a4b20db37aca33db06fceff9f60d2630e3404376a1d631231ff163ef9dec6
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Oh8f/vJVumnnK:1nbZeMrv/hGth8nvRnK
TLSH
T12CD3874B3A743102EDE59A721CE050BB5E3C716D8F55A5D438B620688EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 5478506a78256e28ea5bf402ff26e478011e7ddd6a5dd19f37040615476ddf8d
MD5 a0a1acdb50cb5e6a0dc8afc12951899c
SHA1 5eac8e6a3cbf30d4e69fc54145b462c0b8c59346
SHA512 ad17847703c06fd0048cac228ef2362517313dd6dde69fcaf6e32d6ddd2ec10dd7f7886b01db850d905574ad089a2afe10d98059ee0364a25054f6f1f3fb5bc9
SSDEEP 3072:Oa9+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g1:J9+hFD+7t56OD9ZfSAppr1
TLSH
T107D31232AA94D877C9FD6541F157A300CE666CED41DE2A0A444A9F8EE19FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 1da81bd3842a091e6bd3a3540e38b41778ebeb4084c224621006b7fb09a25324
MD5 50915f0505c29828dda74b42b6bbdc67
SHA1 1777a30f5b107ae5bb20d8d748468ffee3169cf3
SHA512 2f26b20c48a31ba8eeee6e82453e05d59c6edb785c57d9afe312251c218ca8848eacb713c440c20dc6495f6c3835314e2d8061d83f9c14df8a5dc32b41137a00
SSDEEP 3072:xHc+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:Jc+hFD+7t56OD9ZfSApprE
TLSH
T17CD31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 357f7141edaab368f064e97300950d36c46071ce7051958633fd960c7f75a5ad
MD5 657a838e5fb6021c751ae5f784d90244
SHA1 29173d65925ebf2b7e27c497a5dc61545497a0a9
SHA512 b8e806bb846ca9ce2241b15378067fa454e5b299a2d4d594a5417a09d23fa369e42edd75909d84b4964dc143de1a157b03102e4be294243f0018f8bdf3d0444a
SSDEEP 3072:Na9+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g1:49+hFD+7t56OD9ZfSAppr1
TLSH
T15DD31232AA94D877C9FD6541F157A300CE66ACED41DE2A0A444A9F8EE19FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

585ca98b-4ae7-487b-8e6b-8da9fbf08b1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\585ca98b-4ae7-487b-8e6b-8da9fbf08b1b.tmp
Size 11KB
SHA256 98d40be07ff877d403bf79cbcd1871e40eeed6d3d1947db627deb1e4eae6375d
MD5 b41307ccac5c28f67aa7f3564b14ea0b
SHA1 9af48db5ea404b362ab4d4560ac7ea8dee066fd6
SHA512 0aa06a2804cc807713049fb0ef3ec3be329a7ee8b14cc287bf1b8f7c1d2c07f322ee2d7c60ca6eaa32045897fb5535dcea5574255365f799d1e3004936150e97
SSDEEP 192:sxZsRkd5X/fks9URbeLdpmiHW6+WNBOm/Y36gs9Ig4J:sxZswX/fks9bntHb1/XJc
TLSH
T18332D7466E24693B8CC7D25DBA25BF53E2F9143295D40E49E6FCCA2C08F66DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bfa34ea59a3ef3da3b1d5a2baa060c4a29e7bd4a844ea8318fbf9880d1521ca6
MD5 cc3afed25b84b46144cf4e067e41daf0
SHA1 472af5bce0d9757afd5ef13b2a94fb010a70c215
SHA512 42c72831e9bc4c9941b6ab312f3d3f0df024a135d7de897d94568266f583046afdbbbd0dcb7d88f57b26a55468ebdcf9dd34db8b71595cb19e058d964d4a1bb4
TLSH
T1C76152C6A4A397E4FBEE61FC4EC105CB362CAD8845430E76A9B5DE787817395713C442
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597238.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597238.TMP
Size 2KB
SHA256 7ee768a6102e528e436a8f8c4dbfc04a1d688c7fb4fc57b6c581f1b71625a8df
MD5 c628db543d2ad56dd81c3df0f7a43532
SHA1 d20d7c807f70974b073f3da26beb021ed54b3ce0
SHA512 a4bb0968f88f01520fc9f7876a82234ff9d915cb4f285c39e2997c3e76ea25ad0c6eba196027913efd07e7b68244731a65789c58a2452eb2ef53da999e2381e8
TLSH
T19B51D48658A38BD4FBED61FC8DD212CF3B3CAD8086830E72A195DE797827794B12C050
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a4dbcb4a893f32f3eccb2f9bc4e83ad4045b128df5d34ca2a6122fbe962f0107
MD5 bc7ffcaa868a8bf829470b8d4494fb95
SHA1 e8076117b30320fe93972286e7939ee475501694
SHA512 ba0b27c9305b27a07fb3c97d1c0cc44de317874c8effba22633370039277ee19bb46eeb91befee719904bbc12cfdd5e29e2373cd3fa195ef5b956c7a4f69419b
SSDEEP 192:sxZsRkd5X/fkstURbeLdpmiHW6+WNBOm/Y36gs9Ig5uJ:sxZswX/fkstbntHb1/XJ8
TLSH
T15B32D746AE24693B8CC7D25DBA15BF53E2F9143295D40E49E6FCCA2C09F66DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b26ca3aeeb68c0c856da604b4e4ab5c849252f4fbfd373fd0a65a04412969627
MD5 9e2fda335956b1094bb6bae6d63bd1c5
SHA1 c35d78259ab2bd42622ea05fb9cf7a19e1cdab6d
SHA512 c15002f8ea00c369c6c93bf65a64fd170a69b8092536aab8aff18d70400ac573f107cd62bd47b65a990247a07441a029ba0348e0df65f7d1be08f2ce438c95de
SSDEEP 192:sxZsRkd5X/fksVURbeLdpmiHW6+WNBOm/Y36V5s9Ig5QJ:sxZswX/fksVbntHb1/XEa
TLSH
T11E32E746AD24693B8CC7E25DBA15BF53E2F9543294D40E49E6FCCA2C09F66CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c5b9c79718e4b68bc7bd7d7c6508066f9007d6ae2131e290fdba5048d44f54c0
MD5 c21f1f7b4702fa4d046070eaa4eb576e
SHA1 c57693b56e7ae60ce9cc3960c6ac80addac98c70
SHA512 f6f159be19e47d1723a6faa4f63749d3a81db08b6e468a57055fc1d9ebb1e4cf4ffb63661d0e9512734138919f08854092892449825589ced310e0c05dde87b8
SSDEEP 768:cmKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/DroCf:cmKlm7QWvUYe0u1ja8/L/E/wCf
TLSH
T133C20A3B740CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0086bba8-714b-4e7e-bc0d-5acbcaf7e800\index-dir\the-real-index
Size 360B
SHA256 d3c2a4496029f7bf6d030dbd35911ef69fdf62f0f9e2b8b8a0a3efca5ae6b56f
MD5 2a090ed89a2f42959d6c96b0b12d95c0
SHA1 81731332d906b5e01e387c6c17e04e25bb170002
SHA512 8af377b499c305c8ddd4aeaddc08943f9401ffb13b3661ce7db32c2487fdce19d64ce41721254ad97abf6ecc66ddef733155cd0477f4ccc3af2fa44bb1e249fb
TLSH
T169E02B5B8D135146F808513674BDA1B5973124ECA3242E0F64EEC05A8CCA384FE0271C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591e8a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0086bba8-714b-4e7e-bc0d-5acbcaf7e800\index-dir\the-real-index~RFe591e8a.TMP
Size 360B
SHA256 58fcbdc3d11c21701f2e81546c11965a6d7690bde6435769d839b806c4d6f4c3
MD5 a3172ea8764454a4d815f43ab60a3114
SHA1 50cbb9e98df47be678715b6d3041ca1ca3a3c4a3
SHA512 99a0506c03b075b1e65cc4f98d9f61909e672d6397caa145f108dd2470d8c9a8129d65a316d707801893fb64b5b6b9fc824d373381b810c87c30efc63e7ac0de
TLSH
T17CE02B5A06138245F808417124BE6171A2712418E320260FA1EA8056C882B849E02B14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ef618d8971528b41f6300c7d2768beb0571f0d0083527cbb46c8ef33d948a344
MD5 fbd9207e25440fa7f0af119ff6d36915
SHA1 7d35ed1c37e8117793c836c530b844077794bed6
SHA512 a0ad769a3e4f64738db205d808fc8702e1d1fa7f70742c1b46674afac5ae467ddbb978b878ce59d1df8b9a8235d0b42fe645ca3563e56ebecfbb2ca31ce8c48a
TLSH
T182E0C0BB3EB33410EC6FE7C6143258A00041B884D418FC0F142FD79710733197049D62
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cc3ac38aa7b91df3e3a4a38c55cfa24616c48d8b54865e31b9189210bd582bdb
MD5 28e2090fce55c5492e5af6f56308c39b
SHA1 793fe52c1232c241bdb21b5162871552a5cad424
SHA512 cee5897e49b03db969ab73cac8fa49c6fe7ae3d43b6e710af4d709858822da079c78c300265bcf989e6a1fd3d35dddc14e122ec675dc6eb2450bd98e9fd4438f
SSDEEP 384:nVmZcI6sNRITg38bpT+h//F+oV/osa+VYObo9:y6te/txxohg9bu
TLSH
T1F9828C746C78ACB699F79BA2F5433B174FB4506792C81E94DAD8AF1D05CB2981303C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6c26f07c595153dcadede52d7e31b020e3fb6738582a9263dfd5dfc17d4ff84a
MD5 3d43b27db9d2337de7b8c9f51a0f2ec2
SHA1 9d62faea28981f2a5af43853ed1d9860b5ad7269
SHA512 68d5d9c45cd0ee9a72f9a9eef9bcd20faa5a47cef2e3f97d8fe6a68149eec09ade2d240bd216875e5a99656c33d48f0883c5619dd5bc477e622827b08442ace7
SSDEEP 96:KqONkhQsjpfbUmjH5ih/cIPURHl8h4otop5zaDLBKP4v+Y1xf//ojdAxXRtIorO7:BONp6JUm0QmiUyg1so//F+o6BCR0U6
TLSH
T17002D839BC787C7B8EF39E45B0477B239FA4106BA6955F94DAD81E2D01D725C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 251596d9360d1c4ad54865dbfc17966862f1327650c530cf3ddacc83a61da1bc
MD5 b280ea41daad154541e20cafac2dd70f
SHA1 d5b96e2dd70bea53659ee64b0e5f1357e0841e0e
SHA512 be59054753532abec7b2417c1db72b0275bd788576ab66b07228921e76bce92a88f5cb8e96a7b73b9e3f47e11853b961b228704a8a9b42aff444c29007ce5cd7
SSDEEP 96:KqONkQQsjpfbUDH5ih/cIPURHl8h4otop5zVDLBIP4v+Y1xf//ojdAxXRtIorex2:BON06JUUQmiUyB16o//F+oV4lNx3/wU6
TLSH
T156120838AC78BC6B9EE39E55F0473B239FA4116BD6C55F94DAD91A2C05CB25C2307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 13fa2840daea503a28bbae496dbe934fa7dbed08efc9532eb8849a50061e6e67
MD5 ebd1e2a2c97e12c386ef86808f7477b5
SHA1 bf6bb5ff0790a59a9c7c2e1eef8c663e8abb4622
SHA512 65dd69138769fee95e689854eb92fe8b9040cb86e785b389805bfd6d13240c2591d3d082a0ff229b0ec21b5406ea3dab11c24f12151fc2ebd4ba62952b8da0a5
SSDEEP 384:nAmZcI6sNR5Tg38bpT+h//F+oV/osa+VYObo9:t6ge/txxohg9bu
TLSH
T1C0828C746C78ACB699F79BA2F5433B174FB4506792C81E54DAD8AF1D05CB298230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

058f70dc-6862-47b6-983f-e295b61b3459.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\058f70dc-6862-47b6-983f-e295b61b3459.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f02bedc0a1d5d5c53257c2ff1befbe0fa14dbec2549f41faa835569a1dffa61
MD5 24a782b7ec433cf0aac5e18cf529c1c1
SHA1 82418edcf809b1842a6aca8682cc452ca2c2d6b8
SHA512 c6dbe819096515259cd5451552337888ef9d8343c9c270166c5948d5000977132ab3c00dcd85b73783a6b8ac54968eb0021b302326372c55e53f0da03da0bfc2
TLSH
T1B5410759A6ED1148B3B67E5AABF6687D447BB8372E47946E10110E4F0A72B00C961B33
MD5 SHA1 SHA512 TLSH

Submit Download

battlenet_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\AX_16DBC585-6310-48C0-9ED4-8D457FD2A7E8\debug_logs\battlenet_debug.txt
Size 336B
SHA256 8ec9523c69d9aebf15e0f9740e4f92bea93efbc70c95c530e873a3090286bafc
MD5 910196ec773a6e202c8510fd1bd1a87a
SHA1 659006ff56c5033609af2acc49f9a14dc7a417a9
SHA512 27d3f2f7d868109adf458adca9e8e563c2617d241a35c77d2acdd4ee4b6a4767111f8d087e1d87106146e4f7241646143ffa0a37d34a1c9837ce068cb30b10f0
TLSH
T1F5E04F2001DCC71D8D82C453AA76ECDAA0B867553AA6256A7300ADCCC981D88F5C222B
MD5 SHA1 SHA512 TLSH

Submit Download

discord_debug.txt

Path C:\Users\Admin\AppData\Local\Temp\AX_16DBC585-6310-48C0-9ED4-8D457FD2A7E8\debug_logs\discord_debug.txt
Size 2KB
SHA256 e4dd68065a81ce1e7e379b8a4e43ff82a7452820814d8cea5039554bd814247c
MD5 4afbb2cd7f4c54093d6ebf9d7265aed7
SHA1 0233e31b1be2486644bb0453494f3471018a9e26
SHA512 58709bb8a36672973c3681130d175edc2a22d4a19b43e1de22b8fad298b6f6ae5d5eebee05a970a2c36a8fabfe9369335eedc19eaa78260bb345d76657731a6c
TLSH
T14C51083640C98B1D8D55426F9DBBFAECC7B086683F6F33518585AA8CF89480EE8851C7
MD5 SHA1 SHA512 TLSH

Submit Download

google_token_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\AX_16DBC585-6310-48C0-9ED4-8D457FD2A7E8\debug_logs\google_token_dbg.txt
Size 7KB
SHA256 86930822ad9f56432eb5f56561151711057e363b148930ff140ccb079d40e881
MD5 a9dcd257c30279b932f09d140e9aada0
SHA1 6196b5e5e1ab2fdef8abc427d938ab989b337ad2
SHA512 c9064ba60ceb8761cc9d81eba1cc87a579258f600438d03377d8f8800956d060bc2b0f3cb0aba5bbf6a79e620503b92a02e3e8639abc06730ef93eaa2d29821b
SSDEEP 96:c0Ssx/P/j/L/1/1bmV1LBH46u/xZ/RJPZ/E4/0/H/cvmRimsJPZmd/1REvoR+X9R:SWZH4G0M/+fEsU0eMO
TLSH
T1BAF149159DD5C66D595AC1AB09B6DACC88F48F346BB7362E8304CC48EE85C0EFCD6316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0_ApproveDisconnect.xlsx

Path C:\Users\Admin\AppData\Local\Temp\AX_20814656-CF38-4E78-A6DD-F11EEE1A2D7A\PasswordFiles\0_ApproveDisconnect.xlsx
Size 279KB
SHA256 f6db5c9a40b2c1545d3692e62d9003e6b30c37d2ba175bbef21b020eb70d289b
MD5 c3072e223c94e90d40a6c50c83ac5ccc
SHA1 48be2933127bbe319ef0b3d99bb0b7891ad45a86
SHA512 3568550f1d075de324a17f8832e70c039645952c4936686d20ae2ff999d79971f989a229e0b0541acd0143088b4872700433d52d1da2c3195d4bc48130586c3d
SSDEEP 6144:9pievrbk0gFgbqqFufaPWS5dETQ91S33QCFW+f1DACN2X8m:FvU0gFgiYdETQXSff1ZNo
TLSH
T10C5423B7C98F839977D10F743BA00C6509CE769EC1D549486D5AEE42C893C0BB626CAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1_NewPing.xlsx

Path C:\Users\Admin\AppData\Local\Temp\AX_20814656-CF38-4E78-A6DD-F11EEE1A2D7A\PasswordFiles\1_NewPing.xlsx
Size 368KB
SHA256 986222ebc3feeced7b4dad5461994d83b59e09e117e65c10c80789d9d3e265de
MD5 3f2681fc0254fa63ef72399332ecaa4e
SHA1 f926ac2ada61514ab57920fa7437cc7fd5d25a0c
SHA512 8bc01324d90d4644f22db79923d6bdffd70b965539a81d4569feec0caf2609c38dcaafb930d20833708cc2ff2106a670436bc068826ddc915cd4809874cc0fc1
SSDEEP 6144:LFcXwbNhhb32xD3SFiNx8Vl4UaoFpUEL5DtfPE7Pf/N08ON+bnH1pQAAxE0GtLPN:LFcAZvgNxMl48UkXE7fN09+jVpN5TLs2
TLSH
T14984238C45A054FD735816493BAC9EFE30ACE8D7B67E9F3D7C0A6C4996297A12241F0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_StopWatch.xls

Path C:\Users\Admin\AppData\Local\Temp\AX_20814656-CF38-4E78-A6DD-F11EEE1A2D7A\PasswordFiles\2_StopWatch.xls
Size 421KB
SHA256 d570120486c3cca6594d7b946213091281a59b988276f71d72fc17598da5d0fc
MD5 659b60abe186009b9e050a919587922c
SHA1 ff459827fe1b214cd29bd45f2ac8ffdf5ed1a46e
SHA512 27f90cae35ad757d6d9fc8ef08df19bdb08709a390e9bc72dbe6da6099837def602094d5474ba08740b4475505796133b257a56ba51649b71865f2f8911cc15c
SSDEEP 6144:fEfHw78nPwEhNBkUMvM4t9SZzsPFKtNeqSps6CdzseH/mnxPvT+vCP2DerH5Plf3:kmCPXLH4tea4feWV/mn9vxfHffVlPn
TLSH
T1309423B0884250793B5ED4CC80FEA7F4EE626842E4834E319472D1DDA35DFEE47E59A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3_PushClear.pdf

Path C:\Users\Admin\AppData\Local\Temp\AX_20814656-CF38-4E78-A6DD-F11EEE1A2D7A\PasswordFiles\3_PushClear.pdf
Size 105KB
SHA256 c14b980dd864e578db47b9b978ff36f7c54ca59c4b977a6fde56033f0dc4a2e5
MD5 f1a6912a7e0c79d4af12ad9a313f5a4d
SHA1 db3f592984de5f74870b35fe31f1223fa01053df
SHA512 b8a29159d7c7868d3cfdfcbd3482d5a90eef07e528a5cb5a0f850243ad057a4051ac5622be8dedd1bfa01e773e4941b288fc2627e96ce9a913f047ec0cb762a6
SSDEEP 3072:fOCPWotxdg/af61Z9W9nyjWlhAyFQ8D2zOlSd:fhTda1Zw9nQWlhNFQclSd
TLSH
T1F3B312444A5ACA6C782576472D304A4C78DA16CECB3CDD8B92D1BCD07B478B54AB8D8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4_SuspendClear.docx

Path C:\Users\Admin\AppData\Local\Temp\AX_20814656-CF38-4E78-A6DD-F11EEE1A2D7A\PasswordFiles\4_SuspendClear.docx
Size 192KB
SHA256 674b9d3a583e9bc05ebcba1537a0f6f5f74959bd91a2e8ea4969188a6d4002b4
MD5 2c5a33d89de1121631800ba7c7cf4425
SHA1 e28a9ff502787bc5b57feeb2feacb8ea848a5eb3
SHA512 921b75ab63ccfa945023ded93e9eee50d543cd7a9f5a3ec4b07cb3f78e957c3215fdf676133c867d238943afb8f59084adcbd4b7af654797615b70f5f26ba5a1
SSDEEP 6144:hH1otXn246Oijc78DOgJbcXVP5fSrjdK4WlSERMv95:11otXn246Oijq2HbcXR5oZgEE6v95
TLSH
T18914136CE784AFDA44038B66CE49E912A61D08B73FA0A9D75DBBC43098F25DCF601D47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5_HideFind.pdf

Path C:\Users\Admin\AppData\Local\Temp\AX_20814656-CF38-4E78-A6DD-F11EEE1A2D7A\PasswordFiles\5_HideFind.pdf
Size 378KB
SHA256 3912d1b1a9181242516b0f4e73c664b77531da8edaca566cffa2f9f23cc54f7a
MD5 f1b895ac894d160cb5e132982746b109
SHA1 647ab65548f08ba72a21a60822cff9c5254e0635
SHA512 662354513bcebbf3ab2d4f648d839f11fb075873ebe045cf462cfd15babbea8fcd3451d39ef99621f835b1728e0301996fc6077b0b71300b63a96e86f923d96b
SSDEEP 6144:cB4/6sbhYyMPWdSNvIMmPNAAafp/wozdqQ91DHLs1GkR5yhqYXhhzWd9IkZysBOu:v/6sbhOPrvmAAa1zEQ9dHsGM5yhXzI99
TLSH
T11A84233003663A58EF6E2006DDD553A3D8A752C3EA895D7B804CD16E7BC4B9EA5F8703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6_SyncPing.cfg

Path C:\Users\Admin\AppData\Local\Temp\AX_20814656-CF38-4E78-A6DD-F11EEE1A2D7A\PasswordFiles\6_SyncPing.cfg
Size 359KB
SHA256 7f95052d06ca68a6a130614165ccd5718d5aad8a5f39c7bfb38e23cb8c89ee48
MD5 57fbd7439db60f49ed552f974135acc9
SHA1 ecc110fb5532019944d2b2bc751dfd3c74c9f3ea
SHA512 767f94a08f865d0d897f972e5d3dafa4d5627131c54e4483b2fd5110705ac5263df0c6199eceb6bf35fcec8098cda0af280724854f20235a260f6187ee8991b6
SSDEEP 6144:HKH8yWKuHotJJSBjGarCnEHJgAmyVZC44PnS0cRjzDZJg6XuUdU6PCG5/Ch:yQfItJJYrymgAm6fpXzjgA1u6+
TLSH
T111742354E43657E9AE57F70EA8D9F8832F6C2B2ACD21E6D8F5C4C64C861B06EC928411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7_containers.json

Path C:\Users\Admin\AppData\Local\Temp\AX_20814656-CF38-4E78-A6DD-F11EEE1A2D7A\PasswordFiles\7_containers.json
Size 688B
SHA256 b32a837702b91f3d6c3a6a50da2e31f1cbe6384e991aefd08eb595a05dd27761
MD5 332d1459439502d9605d59b2c597af52
SHA1 aeee847012744a06ccd5201f288efc6c0ee6094e
SHA512 18ebc86d13eec67ac1e3705ce9239598f1a9b7ea5d5406ae41b854caba080d4d9f9cf3965643b793e6c8561f96177aa68806bb7ecb700e8515e8ce3be0095278
TLSH
T18901D1364507546EB3C503A912426D22675C60B1D71EEEE9E8360A4E4ADC3E6CE31BFF
MD5 SHA1 SHA512 TLSH

Submit Download

8_HideImport.xml

Path C:\Users\Admin\AppData\Local\Temp\AX_20814656-CF38-4E78-A6DD-F11EEE1A2D7A\PasswordFiles\8_HideImport.xml
Size 564KB
SHA256 be4bda5e277f490299278b81db3ac073f6435ecac249eeb9542b111a877300f8
MD5 6e46a4169b8e2900d14446f2610bc07a
SHA1 64e7f91aed25ecfa82695e272d363a7a9a7b89b3
SHA512 320bf542fe97c3f78ac331c20757f9c724dccd153d27a23709e6aff3c7513bfebfb687b0cc49edfc7a990eaca58c05c4d2bc7a33d83e38712bf9c5c7aa0719e8
SSDEEP 12288:dloyPh/6+3Lu9HFqV33KIEmEcluV8dmvRKd8e15KWeB:dlogh34lqVu4u++8d8m50
TLSH
T184C423B942BCBF39E2B9602CD24CA585D6E198532D78543B08E8651FC1F7E68EEDDC01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B8D707F2.dll

Path C:\Users\Admin\AppData\Local\Temp\B8D707F2.dll
Size 2.1MB
SHA256 b9340594a462e6f88bca5e828c1c70e64a7beb8aee75baeabc3d75bb613ecd1b
MD5 b257c2253b9f43a9eddf61d99936bc0c
SHA1 d546e8465dd97f520bd1e1cb77a54e60918ed005
SHA512 36383e47dbd593c57d3b388836142091c658c5d28f231b6769c22d70b4aa4a37756ae34483fd2563f8e1c4e62c207c2dde9d18b0baad7bbbf5de6ba5521eae12
SSDEEP 24576:LqGNBFzt24KPXH94NfUasm+mzhAFNAxhVx52nd6ip/QHK9A/ia+aa7VwJRl9:nNPxpOKAm+WhA/APi6WQq9A/bg
TLSH
T172A58D07A7B940ACD1B3C178CA175613EB7274450734ABEF57909A562F23FE0A6BE720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GT_wd_2285438110912.db

Path C:\Users\Admin\AppData\Local\Temp\GT_wd_2285438110912.db
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevator_2864.log

Path C:\Users\Admin\AppData\Local\Temp\elevator_2864.log
Size 4KB
SHA256 7ebd8b0b8479d6b29d4de4cc151025ac9eab759ee0b64030e7813a1b4b99665f
MD5 1f21ae748c32a8840dddc310cd96b98a
SHA1 69df707ae54bc667cae0e2691ab20e30b6f5ed82
SHA512 7dc587f40231ea12316aa4483bc99bdb6840eac140cea5797db8619b5e6c344bb6cb4f58d98b2c672565240520818711a99c0d4b36b6cab6da99923012a06294
SSDEEP 96:owZdm1nLJLPLzLqzLZLILvLq4HLdELaLyLvpLyL3LpLb5U/LnLT6CLiNLpL0LVLr:SuZ4h95Ub+OOE74xN5U3j/
TLSH
T120919D6F0DDB27BDE29C2F2011433BD08D81B52AA2C4E89581B1197D77BA72D4E4F239
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevator_2864.log

Path C:\Users\Admin\AppData\Local\Temp\elevator_2864.log
Size 2KB
SHA256 5e2a846000c3049ec9ebc8a3b3cef67547d76ff44b47a2541afaa304db361bc1
MD5 6ddadd3e19a21eaa5aa9b34e076b58aa
SHA1 a322c587c7f5c13d414e358de976a41667720d56
SHA512 b024ed4c0fb870371ee3d017906e19538ae43385aacabd6905534f502cf6c5716a982a8ee8d91a03cb154d8f0564018d3f22e4ab52b20fb5d66421c61df4955b
TLSH
T11151B72F0EDA277D92187F6102132BE09ED2F22A93D4E85441A5287DB7B276D0E5F335
MD5 SHA1 SHA512 TLSH

Submit Download

google_token_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\google_token_dbg.txt
Size 14KB
SHA256 a35d47b0ae7f49c2c213475aa7c8d60b14e8d89a7e15a7b9aebac7d623608742
MD5 c66de8cfa086d49f890f57b2c5bd0a5e
SHA1 f5f19918c8ee485b959831a5f880a31b4e3521a7
SHA512 0ccacebb32b713574bc0e03bfa56123b0b0f44bc0090f5c6d1c1c1492b9ca040f4c7a9256a8e1b05dce90ff0b2c3cdffd77d976b027c1d929cd1ef8a64617a6a
SSDEEP 96:c0Ssx/P/j/L/1/1bmV1LBH46u/xZ/RJPZ/E4/0/H/cvmRimsJPZmd/1REvoR+X9M:SWZH4G0M/+fEsU0eMHbWIGz0/++
TLSH
T1EC525C159DD5C65D596AC1AB09B6EACC88F48F346BB7362E8304CC88EE85C0DFCD6316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoft_token_dbg.txt

Path C:\Users\Admin\AppData\Local\Temp\microsoft_token_dbg.txt
Size 2KB
SHA256 830e6f8dac7abc97eca9266c80ab10ce24a3182e08d284c2253b413c5b04694f
MD5 fac4adfd3a431102be25ec0c5ffd333c
SHA1 43ef6104df2e29d8b3d810897474f1dce80147dc
SHA512 4b37bf13ae01c52473c1f0ca84182e2b608f1a12e8cf4dfa669471bc9f3629ac2ff139ea8f0fc4792ab0ae6727b6385fbe4df10b5522cff4209dca96acad969d
TLSH
T1A84156114A68E30706F2849620FB4DD4605BAE939BEB7DA89F08C4D54E0371EDEDA45E
MD5 SHA1 SHA512 TLSH

Submit Download

payload_2864.log

Path C:\Users\Admin\AppData\Local\Temp\payload_2864.log
Size 1KB
SHA256 a694f63c3512d52b54e92cb63c36f931c79bf0c39bb9ba659d1691a695becf85
MD5 9475638c492ca652ddbfeefe6645b760
SHA1 5671b385e2b4d635f304a9073a51be8cd164b5e0
SHA512 85d87f4d50d26bbd6501020a0dbe6494b029958b5673b00e5f0ae3b4f0152da61684b59d8d64f21235f115d7b40e7241cc519f0c9e29545d665a04ab74291b21
TLSH
T12921364440DA357FEC55AB7153B8BFE92461368B6EE0F4622682693E3340B29CB5B734
MD5 SHA1 SHA512 TLSH

Submit Download

payload_2864.log

Path C:\Users\Admin\AppData\Local\Temp\payload_2864.log
Size 4KB
SHA256 aca63060d54e3dd1ba0ca34463a1a34174dbb95c3c3867acc3d594a686051511
MD5 960f881ebea47b8f4ab662ade4c30528
SHA1 4ed347163eaa6956195abc6b84bec5613614118c
SHA512 4cee015df94efffe258caa28d33ef6fdf82c0e628578c983190957cdcf8c46107a1e63a4dce885468020fe00fafc7a454ef8ad8cf3c0a9ae3e9736851f1b287b
SSDEEP 96:oa38WlW0WiwgIWE10ye5tONLxG7Td/kqBWYBPNFj1a9VGDwUe0UVGDwUPKqQVGAb:pUliXS4Byvjbv7jT1rFKm
TLSH
T11FA1015004CB62BFC8617F1E01BA7E880670F88B7ADAE513920D663E6BD4519CF17735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload_4420.log

Path C:\Users\Admin\AppData\Local\Temp\payload_4420.log
Size 1KB
SHA256 cbee018fb5d9f2ccb45e0b179c467d3d55eca14f7b9f106b5e8573ce7a37eb95
MD5 6a6439a6c5ee021ff14c43e6802f320d
SHA1 1e991ef0667722efe6511853a103a09c7f94a73c
SHA512 43470bbe63acd3c3812c950a43b19d38bf038b8cedbd5bbea18f7787b5a87a6c6fe412bfac77ca679bd9abfd51c8881123c10c91ecca4b3de5049e610d8ea062
TLSH
T1D4213E06409B217FDC766F90113E7EB52029B847A6D8B4231F439DCCB361908C95B73E
MD5 SHA1 SHA512 TLSH

Submit Download

payload_4420.log

Path C:\Users\Admin\AppData\Local\Temp\payload_4420.log
Size 4KB
SHA256 2220fe7f658158be1d30d526783e308219e590d929c2fc1a0a524f65abe6ee8d
MD5 5f6dae602c1123992fcd21904a698a16
SHA1 d807903bcec5726e5960fa6a6ef4f5778ebca0e9
SHA512 41b5d0a6918ea773b587c0f55d462a33e738896c96f4252e4b27ff0344a5b1364cc7979695913344db9cba5671feb348fbbe3af666fef4cdadab15f5d3afda24
SSDEEP 96:oDKTVYV0Viw4V3U+DiYAze3L8QGCZGmXYBWqfpwCl80zRJzAWzESzB8z+zCzNzw4:1+6im2KBxgrYgF
TLSH
T13B918895240B61EBCC227F8D20367C9409B5581B39D9FAD30B0F9F9DE66560D9E0733A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pw_2864.log

Path C:\Users\Admin\AppData\Local\Temp\pw_2864.log
Size 772B
SHA256 b05ecb0d94258bf03f6555c79ba3194657277a3bee583e4e097d37e37730ff8a
MD5 c3880a12a9d94aaae5b9e5b57db562e1
SHA1 c792c7f3af742809795e4c6c7ab46e12ba44f735
SHA512 2e7d01887d9c21edc3f2a4e5dd9777ecf58b8cfc922d8ce0065f067204d39d4df48916fa0e25ecba0cb1cfd816cb933ec31175f24ffc534899013380f47f9917
TLSH
T1E6019C2052DFC52D605257BE5FE017F808180AD9E33AFE658A1FE12C2399C42E5532BC
MD5 SHA1 SHA512 TLSH

Submit Download

pw_2864.log

Path C:\Users\Admin\AppData\Local\Temp\pw_2864.log
Size 2KB
SHA256 d7a57790e9333995348a0155316b12aeb0614605de4c8444d35861302a858b59
MD5 7440224f295569b1d5633e4372c88818
SHA1 9648e063025f5eb3826a4d9a5a7df9f34f4954bb
SHA512 22425c5bac63243d360c118c951c2b9f5d6346ef0e72e0062f61eda826087b8656efa74c3db1da6df12d7fbbdbb3550fb2230e1d9b6fabc7d2e4e2bf70b1738d
TLSH
T13D41CD2022DF892EA4625B7D1FD13AF4181836D4E3B9FE798A0B913C3798C41E55327C
MD5 SHA1 SHA512 TLSH

Submit Download

pw_4420.log

Path C:\Users\Admin\AppData\Local\Temp\pw_4420.log
Size 1KB
SHA256 f1aac716338e2f640ab013d07b2f0b43d31b7075129bca5c46ed3c205a94729c
MD5 34e61807865aa4148dd11befb9e5de21
SHA1 81b62d6dfe9ea1407973fb94b40a0852907c1f9b
SHA512 87eb7f8fc2a16c13a9042afdd4f6d17f19ea931368470a5ecda041b6c737e41464fb928895c96bb56afdceb87aa72c84bea7e6e34cb35135405b9ba5614fd7be
TLSH
T12411A22266DBD13F442947B562823ABC581576C5E3F67F2D8A03E98D3B10D858843335
MD5 SHA1 SHA512 TLSH

Submit Download

screenshot.bmp

Path C:\Users\Admin\AppData\Local\Temp\screenshot.bmp
Size 5.9MB
SHA256 66e9faabca57ec2ef1915c83df98067cdc12e4941399397ae267d3965e23686d
MD5 46093f9782a2c3a80b3ab397b38403b7
SHA1 f12915c3cf6dbf6336887e9c5e0aaff32391b9c1
SHA512 0510b597a30db1b1328c86f013c07c163d5bab67f13b79808bdd4668050dd3086675935734e8010c5ba287843c5f5b13f2304804331496e2666c0a38af7c411f
SSDEEP 12288:SQQhBynbg4jjb1gCW2kmCkj57VRXnY+vf5R:SQQbgbgZlkjtvY+vf5R
TLSH
T14256DF23B5AA7954EA2B3975B2FC071CA310EDD8BB48078E852578F0F0B23456D776B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download