hxxps://cdn[.]discordapp[.]com/attachments/1545899367758692443/1552026491318178005/DiamondFN_1[.]2[.]3_x64_en-US[.]msi?ex=6ab41cce&is=6ab2cb4e&hm=7e1e37ac5589a7535f802fd78fd229c104dd001413ac2b20934402304fe74ee8&

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
22/09/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1545899367758692443/1552026491318178005/DiamondFN_1.2.3_x64_en-US.msi?ex=6ab41cce&is=6ab2cb4e&hm=7e1e37ac5589a7535f802fd78fd229c104dd001413ac2b20934402304fe74ee8&
Sample260922-xepxvsda95

Score

7^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5156	Diamond.exe
2644	Diamond.exe

Loads dropped DLL 1 IoCs

pid	Process
1292	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Diamond.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Diamond.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\DiamondFN\Diamond.exe	msiexec.exe
File created	C:\Program Files\DiamondFN\Uninstall DiamondFN.lnk	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{F54B58DE-A309-430D-A199-B800A9A6BB24}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5971.tmp	msiexec.exe
File created	C:\Windows\Installer\e5957fc.msi	msiexec.exe
File created	C:\Windows\Installer\e5957fa.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5957fa.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F54B58DE-A309-430D-A199-B800A9A6BB24}	msiexec.exe
File created	C:\Windows\Installer\{F54B58DE-A309-430D-A199-B800A9A6BB24}\ProductIcon	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1744	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000061aa9e1339fe41d80000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380161aa9e130000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e8410161aa9e13000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f61aa9e1300000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7161aa9e1300000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345763838317273"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED85B45F903AD0341A998B009A6ABB42\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\ProductIcon = "C:\\Windows\\Installer\\{F54B58DE-A309-430D-A199-B800A9A6BB24}\\ProductIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\PackageCode = "71EC1232B3D366C47BEAB2D7C4D7E4B7"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F4083FEFD199A34529ABA7C8B2AC246D\ED85B45F903AD0341A998B009A6ABB42	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\SourceList\PackageName = "DiamondFN_1.2.3_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2545564138-786060179-1728272436-1000\{DAAC3202-3D96-49E0-B783-0A93048C17D6}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED85B45F903AD0341A998B009A6ABB42\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\ProductName = "DiamondFN"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\Version = "16908291"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED85B45F903AD0341A998B009A6ABB42	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED85B45F903AD0341A998B009A6ABB42\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F4083FEFD199A34529ABA7C8B2AC246D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\ED85B45F903AD0341A998B009A6ABB42\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\ED85B45F903AD0341A998B009A6ABB42\ShortcutsFeature = "MainProgram"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3912	msiexec.exe
3912	msiexec.exe
5800	msedge.exe
5800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
5316	msedgewebview2.exe
4040	msedge.exe
5168	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3232	msiexec.exe
Token: SeSecurityPrivilege	3912	msiexec.exe
Token: SeCreateTokenPrivilege	3232	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3232	msiexec.exe
Token: SeLockMemoryPrivilege	3232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3232	msiexec.exe
Token: SeMachineAccountPrivilege	3232	msiexec.exe
Token: SeTcbPrivilege	3232	msiexec.exe
Token: SeSecurityPrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeLoadDriverPrivilege	3232	msiexec.exe
Token: SeSystemProfilePrivilege	3232	msiexec.exe
Token: SeSystemtimePrivilege	3232	msiexec.exe
Token: SeProfSingleProcessPrivilege	3232	msiexec.exe
Token: SeIncBasePriorityPrivilege	3232	msiexec.exe
Token: SeCreatePagefilePrivilege	3232	msiexec.exe
Token: SeCreatePermanentPrivilege	3232	msiexec.exe
Token: SeBackupPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeShutdownPrivilege	3232	msiexec.exe
Token: SeDebugPrivilege	3232	msiexec.exe
Token: SeAuditPrivilege	3232	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3232	msiexec.exe
Token: SeChangeNotifyPrivilege	3232	msiexec.exe
Token: SeRemoteShutdownPrivilege	3232	msiexec.exe
Token: SeUndockPrivilege	3232	msiexec.exe
Token: SeSyncAgentPrivilege	3232	msiexec.exe
Token: SeEnableDelegationPrivilege	3232	msiexec.exe
Token: SeManageVolumePrivilege	3232	msiexec.exe
Token: SeImpersonatePrivilege	3232	msiexec.exe
Token: SeCreateGlobalPrivilege	3232	msiexec.exe
Token: SeCreateTokenPrivilege	3232	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3232	msiexec.exe
Token: SeLockMemoryPrivilege	3232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3232	msiexec.exe
Token: SeMachineAccountPrivilege	3232	msiexec.exe
Token: SeTcbPrivilege	3232	msiexec.exe
Token: SeSecurityPrivilege	3232	msiexec.exe
Token: SeTakeOwnershipPrivilege	3232	msiexec.exe
Token: SeLoadDriverPrivilege	3232	msiexec.exe
Token: SeSystemProfilePrivilege	3232	msiexec.exe
Token: SeSystemtimePrivilege	3232	msiexec.exe
Token: SeProfSingleProcessPrivilege	3232	msiexec.exe
Token: SeIncBasePriorityPrivilege	3232	msiexec.exe
Token: SeCreatePagefilePrivilege	3232	msiexec.exe
Token: SeCreatePermanentPrivilege	3232	msiexec.exe
Token: SeBackupPrivilege	3232	msiexec.exe
Token: SeRestorePrivilege	3232	msiexec.exe
Token: SeShutdownPrivilege	3232	msiexec.exe
Token: SeDebugPrivilege	3232	msiexec.exe
Token: SeAuditPrivilege	3232	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3232	msiexec.exe
Token: SeChangeNotifyPrivilege	3232	msiexec.exe
Token: SeRemoteShutdownPrivilege	3232	msiexec.exe
Token: SeUndockPrivilege	3232	msiexec.exe
Token: SeSyncAgentPrivilege	3232	msiexec.exe
Token: SeEnableDelegationPrivilege	3232	msiexec.exe
Token: SeManageVolumePrivilege	3232	msiexec.exe
Token: SeImpersonatePrivilege	3232	msiexec.exe
Token: SeCreateGlobalPrivilege	3232	msiexec.exe
Token: SeCreateTokenPrivilege	3232	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3232	msiexec.exe
Token: SeLockMemoryPrivilege	3232	msiexec.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
3232	msiexec.exe
5156	Diamond.exe
3232	msiexec.exe
2644	Diamond.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 5016	4040	msedge.exe	84
PID 4040 wrote to memory of 1744	4040	msedge.exe	85
PID 4040 wrote to memory of 1524	4040	msedge.exe	86
PID 4040 wrote to memory of 1524	4040	msedge.exe	86
PID 4040 wrote to memory of 1524	4040	msedge.exe	86
PID 4040 wrote to memory of 5008	4040	msedge.exe	87
PID 4040 wrote to memory of 5008	4040	msedge.exe	87
PID 4040 wrote to memory of 5108	4040	msedge.exe	90
PID 4040 wrote to memory of 5108	4040	msedge.exe	90
PID 4040 wrote to memory of 5108	4040	msedge.exe	90
PID 4040 wrote to memory of 4764	4040	msedge.exe	89
PID 4040 wrote to memory of 4764	4040	msedge.exe	89
PID 4040 wrote to memory of 4764	4040	msedge.exe	89
PID 4040 wrote to memory of 2196	4040	msedge.exe	92
PID 4040 wrote to memory of 2196	4040	msedge.exe	92
PID 4040 wrote to memory of 2196	4040	msedge.exe	92
PID 4040 wrote to memory of 4924	4040	msedge.exe	91
PID 4040 wrote to memory of 4924	4040	msedge.exe	91
PID 4040 wrote to memory of 4924	4040	msedge.exe	91
PID 4040 wrote to memory of 552	4040	msedge.exe	95
PID 4040 wrote to memory of 552	4040	msedge.exe	95
PID 4040 wrote to memory of 1056	4040	msedge.exe	96
PID 4040 wrote to memory of 1056	4040	msedge.exe	96
PID 4040 wrote to memory of 3888	4040	msedge.exe	97
PID 4040 wrote to memory of 3888	4040	msedge.exe	97
PID 4040 wrote to memory of 476	4040	msedge.exe	98
PID 4040 wrote to memory of 476	4040	msedge.exe	98
PID 4040 wrote to memory of 476	4040	msedge.exe	98
PID 4040 wrote to memory of 3956	4040	msedge.exe	100
PID 4040 wrote to memory of 5080	4040	msedge.exe	101
PID 3912 wrote to memory of 1292	3912	msiexec.exe	110
PID 4040 wrote to memory of 2148	4040	msedge.exe	115
PID 4040 wrote to memory of 2580	4040	msedge.exe	116
PID 4040 wrote to memory of 4696	4040	msedge.exe	117
PID 3912 wrote to memory of 3956	3912	msiexec.exe	119
PID 3232 wrote to memory of 5156	3232	msiexec.exe	127
PID 5156 wrote to memory of 5316	5156	Diamond.exe	128
PID 5316 wrote to memory of 5344	5316	msedgewebview2.exe	129
PID 5316 wrote to memory of 5612	5316	msedgewebview2.exe	130
PID 5316 wrote to memory of 5612	5316	msedgewebview2.exe	130
PID 5316 wrote to memory of 5612	5316	msedgewebview2.exe	130
PID 5316 wrote to memory of 5632	5316	msedgewebview2.exe	131
PID 5316 wrote to memory of 5680	5316	msedgewebview2.exe	132
PID 5316 wrote to memory of 5680	5316	msedgewebview2.exe	132
PID 5316 wrote to memory of 5848	5316	msedgewebview2.exe	133
PID 5316 wrote to memory of 5848	5316	msedgewebview2.exe	133
PID 5316 wrote to memory of 5848	5316	msedgewebview2.exe	133
PID 4040 wrote to memory of 5960	4040	msedge.exe	134
PID 4040 wrote to memory of 5960	4040	msedge.exe	134
PID 4040 wrote to memory of 6036	4040	msedge.exe	135
PID 4040 wrote to memory of 6036	4040	msedge.exe	135
PID 2644 wrote to memory of 5168	2644	Diamond.exe	137
PID 5168 wrote to memory of 3132	5168	msedgewebview2.exe	138
PID 5168 wrote to memory of 5764	5168	msedgewebview2.exe	139
PID 5168 wrote to memory of 5764	5168	msedgewebview2.exe	139
PID 5168 wrote to memory of 5764	5168	msedgewebview2.exe	139
PID 5168 wrote to memory of 2580	5168	msedgewebview2.exe	140
PID 5168 wrote to memory of 1500	5168	msedgewebview2.exe	141
PID 5168 wrote to memory of 1500	5168	msedgewebview2.exe	141
PID 5168 wrote to memory of 5988	5168	msedgewebview2.exe	142
PID 5168 wrote to memory of 5988	5168	msedgewebview2.exe	142
PID 5168 wrote to memory of 5988	5168	msedgewebview2.exe	142
PID 4040 wrote to memory of 5800	4040	msedge.exe	143

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1545899367758692443/1552026491318178005/DiamondFN_1.2.3_x64_en-US.msi?ex=6ab41cce&is=6ab2cb4e&hm=7e1e37ac5589a7535f802fd78fd229c104dd001413ac2b20934402304fe74ee8&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffbf770c188,0x7ffbf770c194,0x7ffbf770c1a0
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2008460915879745530,15469255622532491739,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,18233962399179994606,7960826643930935953,262144 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,2842666571016733920,14716846828380181825,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,3316052903622242472,1576053697111093493,2097152 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,17459376829552012394,2519719307113599817,2097152 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,16175362261220958173,15444189432864612294,2097152 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7528810397518701020,10530116850443468301,2097152 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,11059058295987205366,15363814549000507722,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,9472568431255151496,11623166128114322376,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,12656211355407908946,370082348145391220,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5800,i,15700309492808872158,4290842834503545247,2097152 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,16337954665192162015,6704467264528669974,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,16337954665192162015,6704467264528669974,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,12775278591987101539,11212422275682379237,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,1208810711223110568,13571905741124635571,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,10095266106309705519,7809384737309114817,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,12265272381051490247,6334549167045447755,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,3173936770726666308,11005287233932178433,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,12928897457224195574,6836465805479790597,524288 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=772,i,9009738654695643876,11672899032944938262,262144 --field-trial-handle=2308,i,13908108734333188100,5557143975636454505,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4448

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\DiamondFN_1.2.3_x64_en-US.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Program Files\DiamondFN\Diamond.exe
  "C:\Program Files\DiamondFN\Diamond.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Diamond.exe --webview-exe-version=1.2.3 --user-data-dir="C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5156.5312.17146872000459209502
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5316
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffbe500b078,0x7ffbe500b084,0x7ffbe500b090
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView" --webview-exe-name=Diamond.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1844,i,3576041910125357076,7434284362440522971,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:2
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView" --webview-exe-name=Diamond.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2080,i,3576041910125357076,7434284362440522971,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView" --webview-exe-name=Diamond.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2252,i,3576041910125357076,7434284362440522971,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView" --webview-exe-name=Diamond.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3412,i,3576041910125357076,7434284362440522971,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
      4⤵
      PID:5848

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AC0509659476561B760E4FE1DA926449 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1292
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:832

C:\Program Files\DiamondFN\Diamond.exe
"C:\Program Files\DiamondFN\Diamond.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Diamond.exe --webview-exe-version=1.2.3 --user-data-dir="C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2644.5188.15426546531793255717
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a4,0x1a8,0x1ac,0x180,0x1b4,0x7ffbe500b078,0x7ffbe500b084,0x7ffbe500b090
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView" --webview-exe-name=Diamond.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1816,i,4523292725975932736,9406673091866622445,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1812 /prefetch:2
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView" --webview-exe-name=Diamond.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2104,i,4523292725975932736,9406673091866622445,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
    3⤵
    PID:2580
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView" --webview-exe-name=Diamond.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,4523292725975932736,9406673091866622445,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView" --webview-exe-name=Diamond.exe --webview-exe-version=1.2.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3560,i,4523292725975932736,9406673091866622445,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5957fb.rbs

Path C:\Config.Msi\e5957fb.rbs
Size 9KB
SHA256 65e2af8ea900b026b68424ded601ec3b4935f001631033205bba01043e8f5ae1
MD5 a9f2a6afeb48e44787639ee63b249e4c
SHA1 e5c1d369191a3e8ded1384cf8965e57ffcb63ff8
SHA512 06eaf320048319b10bf9ce23cf99f9d1e2b0a9f813693db943a628a05791569123407242f23e098dc590251a9ac99005ed55c08380185ff2a6ed0c69ef070ab5
SSDEEP 192://S4JDrj834ehIhH1NGpH1N0B4AjWCiIFypj://S4JDroJoVyV1N
TLSH
T1BB222146670982E3E8A78F34C70727123BE3D7C58354964B88DCA1689F4638D5F666CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Diamond.exe

Path C:\Program Files\DiamondFN\Diamond.exe
Size 17.7MB
SHA256 41b50f1ff437cedbe0ffe4cff575e177f65bc67338a79fdfe7ebf2702c1b64fe
MD5 0aec0b4351ecd9f45940544711bce614
SHA1 dfda892379c5790b4e4ce6faa9d6f758b3f807d0
SHA512 61fc7b3970235302ce51abd1bb1bdb1492c6bec0c003248180493bac6809dbec82018b10ec5d14144be0d67e3429ec35949a238346b4a11dceefd65cf3c0869d
SSDEEP 196608:Fjt5EeNQZN0ZJ3elW/WSenNJsM4Wkld5EunV+D:DOeNQZN0ZJ3elWOsM45quV
TLSH
T11F17E7247A5B9968D04BC470C24686B60A313CCB0B35A9FF4495BA393F7EBF45F38259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiamondFN.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiamondFN\DiamondFN.lnk
Size 1KB
SHA256 b1424f6a26dd8c826d1b56bd61265d9654564ca91ccd77b286199ea76a9a5c41
MD5 741932c4204035699e8d8f46809b7d82
SHA1 d0d52d1626b7e5d8db3e147ac8c3213e393174bb
SHA512 0cfad66b6ef68b278959fb120cd2c3ffe034fd238b1548aeeb3ca1c452b087c6566e710fe3e2ae98ebad09b7b383001ea48d47d89d3549f6eabf3af917a2bb90
TLSH
T1A241A0501BEE03A9E3F24735B7A60A2357317D03E2614F3B46AA95890D60A44D978F7B
MD5 SHA1 SHA512 TLSH

Submit Download

DiamondFN.lnk~RFe595ab9.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DiamondFN\DiamondFN.lnk~RFe595ab9.TMP
Size 1KB
SHA256 4c584e7938140f2a9208b368503302fe3568651917a8f779073eb551890f4c5e
MD5 ecbd319fce025351e2c02ea81ca46a9e
SHA1 d7008a6d5d467ba76b5191171591a0e42a469dea
SHA512 48d4a1a23080a14eebb99b1eb42c58dc2faf3419505fdd3cb2bb404674c01791fc7cc4bf6d9d9fec1d91eb6654fea810ad8382e96787843a8922797ab766840e
TLSH
T16141D2501BEE03A9E3E24735779A0A2257317D03E2614F3B45AA55890D60944D938F7B
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a61abde4c403038fbcba9d7cd1146314ee5200b67fe0b69e700f452a518f4d8c
MD5 9ddfabae6252c3a2f91f8be35789fc2f
SHA1 1fd1f736b9db1aa41efece011a7e2ab1f75998b9
SHA512 1c4f17767fb56cd4750df16777f1a354330a627dd67c9adcada997a7bfcaf88da512537054fd26e282b25a9ebc7b7b93c162114af3587fe3ba7a714e36646c57
TLSH
T116D011B2FB0A08B2E02A30322200830A822A802228022A82A228800828C00282AAA080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4aad8f19761fa37dfc59ba05a1eb3d7a6e2c0e7e8a440feae228ea8fa4acff9c
MD5 5543311c88a457329bf7f848fd15bca7
SHA1 1233b9005429853ed29f3a5e576aff4d1cfcaffa
SHA512 1cfed80fa6c2fe7a8e5e52fab52c4dc7e4a6415be97397ee97ccb9086d54eca147b6da8c9f2126d374add73c2006dfdb4b2c0f0383a6f21a6e7f5fa4a5c047a4
TLSH
T130D012B1B7490872D0163032220083054215801124025B83A124400404C10642569040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2464aaca98429b1ff081f7371661964d97dc361c97988c58ce0e7e87abf513b3
MD5 51de23921f73efd13a1633f8c83ae5d9
SHA1 bfa4fd01f0ce97ee7c5c9fb4c4e53ccdb8ee4e5f
SHA512 faf6c747dd1c5c3fa51aedbb4ee360f8b58d8528dd01d4b42963c709e65fb3a30ed50795666aa9e5211bb06442a7cf312c620a6fa00c74c1603d47f48b8e76e9
TLSH
T1C8615EA794286D90F77B0EB097D572873A3889BEC4A31E5C24B8E078ABE63D441105A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5907b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5907b7.TMP
Size 3KB
SHA256 e5e5608f9a32b828ea8e76c64f43800ff2cb5c7dc16aca2c57ba8c66fe37b83b
MD5 98f2c859c6b1305592d8673d233568af
SHA1 da40ddb4504dbf5fd2352bc6d6e9344c1c46c022
SHA512 4aee4e2a0b6772058a7ffcd3d457f5a9bfbcac3af79a5f649eaceedcdd05badbc16fee58d7fcae7df8d5a5216add68e56ba05ef8f4c11c7ea29d4b678ec4893d
TLSH
T1D6615EA754686D90F77B0EB0A7D972873A3889BEC4B31D5C24B8E078ABE63D441105A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2d4cf3c4cddc41d2aa461271787dd9f5dde4d64f206b6fa07211280919d6eba4
MD5 09556b2342ba2fe8fc353f64cdfb581b
SHA1 442fdce0af89968ce9b0d6a399589a3b8b71fc21
SHA512 694dba0b36672f39e9d6391a99e0ee4dd60862d752e66453fad2e04407f88a5d190b639fcc9085f4901fd78235b34a008eccb6fe3f62c3670b87964312514489
TLSH
T147217BF3C7E5866EC9051AF06A14AE1BCE1D051942183C1BC9D4EF6BD7E30A2E10194B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7972e586e575eb2f3caf3fc0311c58c87a1c6344320575d66d7495972873770c
MD5 bf5da615ba47c07aeb4a1ad931be06a0
SHA1 cdb6a25fc7d36eb25a899ae8b3f0310517cd7bd1
SHA512 d3aed6d4c58d22747275711c139fea861d59b3807f5f6c880641cedf882ef46fa1bc4c75b52eae25aecdb1e72b4454cde0c85ff74423aaacac6af18d3374a925
SSDEEP 192:sxZWRB5A/f9sxTIdpLHW6+WNGYrVRK6LIg5zJ:sxZWVA/f9sxMLHbGm7
TLSH
T13A22C856AE38657B8CC7E20DBB25BF53E6F9503261901E48AAFCC61C15E7ADD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f558fe7e19cbe4d12781d3a4ee44da947e1416b36e5a56777c5310f12e03867e
MD5 57719f0816d25a3948943e9a6cafda54
SHA1 420f99ecae15ae94bc09408c8646b6692c5826e1
SHA512 1bf86cf28e200bdfb5b90593d0976953a7c4a86cdbb71248a23d79226528a9a26214193e33a511c33b4bcccc09632d9db1c957912e1da68c35453caad337b75e
SSDEEP 192:sxZWRB5A/f9s3TIdpJHW6+WNGYrVJb6LIgrJ:sxZWVA/f9s3MJHbG79
TLSH
T1B522B8556E38A57B8CC7D20DBB25BF53E6F9503261941E58EAFC861C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fc862db7344a68886bc61da5bf06e55e662ef12060b59979be1b3b6430c7875f
MD5 74f624986ce5e0ca2471c95d5dbdb6be
SHA1 de437d5f9fa70f024259ddeac265b7ea84d68915
SHA512 debfd0ef9fd50575b78532c8f1baba97bc66385fc3e8044e6df64ba4fcfa168211b34c8d72f62b0e5f93cd6c8d46573da2fa48817515a02a6f822fd1942699c4
SSDEEP 192:sxZWRB5A/f9sxTIdpJHW6+WNGYrVJx6LIg5zJ:sxZWVA/f9sxMJHbG/7
TLSH
T18E22C755AE38657B8CC7E20DBB25BF53E6F9503261901E48AAFC862C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 aeb931b50f7a43c1b9f3540908e38ba83bcf4db609d27a81a2c69483c251a91f
MD5 be5a27fe314a04246e8e9bc0d423d72e
SHA1 9128e4b7dd81f430c22acc49c3d8d9cdefd8d515
SHA512 073c378bab6ead0683c33cf7f368aef4145014527094a78f809c4de0edfe48200caf3b44421a33f16393a262b12c6f58c7fe62ea91b2046a7960cf1022758ed9
SSDEEP 192:sxZWRB5A/f9s8TIdpJHW6+WNGYrVJb6LIg5JJ:sxZWVA/f9s8MJHbG7V
TLSH
T12922C855AE38A57B8CCBD20DBB25BF53E6F9503261901E58EAFC862C04E76DD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f57e352b2bf5cb684b308887fc4beaa2b04e0970a2b86951145025056eb50148
MD5 e97ea8f089e4aa214e78144401e57cd3
SHA1 7173451e7dccb816e7fdea6aef4bef8be7c525ee
SHA512 22931a19c6a0592316eed3c26e588983eda0eb71a84b792a46e6bc5b1e5ebcd0da6ecbd6293692f660e9016ca0b378f9aa8f60781c6f9ec3fbf129274b6a383e
SSDEEP 768:6Pa0JX3Wv/xh98F1+UoAYDCx9Tuqh0VfUC9xbog/OVWmLlEy3zRroQrxav:6Pa0JX3Wv/xh9u1jaHmLKAzqp
TLSH
T12EC2FB3B684CCB7E4FC01A5DDC566F976E9802C7A6548E8047FA984C02C77EA61264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a2c93cfa31558c1432a563699180a08186bc5ca977c39b5ffae384410532fd25
MD5 5e73bd2580e11d66ff61ba68ab2527d8
SHA1 e137cec6d6d18b50b5b283407cfa32171f5ddb6b
SHA512 ec460bffb5c90697624a9af9f5ef5e359bb24ff104cc9ddf3b20aab59cc4e4a8795ef88604c60c84f5118b3cce98a4f99997ae505177bb988cd9a05fe98da879
SSDEEP 48:KMCIfK3K0nyRQInK9Ocbyp+mIPK7iYLyD:KMC4K3KuCQAK9Oy6+mUK7iOg
TLSH
T13FA11B0431BB4641397D391C81B49B2F8A4232633169EB7B7FBD14A29E67E095DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a3f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a3f7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b262357ddbecb4850e802e062ba6d8598f6729b52b12b87fc567b18d89beceec
MD5 ad80dc7e75383670e6517d5310248462
SHA1 b20dfb7831ffd7825db2af4c643ed99453422712
SHA512 482bbc9aee5b0c640b1df3c5c8c4791755845ba0cd4869560cd18727733a55e25cb50b17ef8d6bf9caa471bfd3462fb5de55a82ca511165dede1c8aad62a2113
SSDEEP 384:LZcItsNrA/OGGSgMuOoi0usyQIuIYXnsa+VYHGw6oJ:TtsUnC1TIxYXnhg28G
TLSH
T1DE827E725D78AC3B9DE3A681F64636139FB49127AAC53F44C5FC6F1D00EE6982306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fe2e37e530b21eabec69d08d0ed977eb3571694ac623505c877d65203ddb372a
MD5 75832e82e74d212465f800335e3de558
SHA1 1b3153c2016aaddd8c09a861f8ba0ce9908c983a
SHA512 189b7509818f987b5e6f271263239295736fc47a3f842128af7376cd21b7e7aade2a4f3de08e229f6b63884d7ab5a7d8fc767d10d243e44b209c42d732f1db9c
SSDEEP 192:WON96L1QmiUyHqNqMgmSuOoiwoSus6LQAxvYpS7U6:WON96fnNqMgRuOoi0usyQYYE7U6
TLSH
T18A02FB38AC687C779EF3AE45B68677139EA5213BAD912F44C9E41E1C00DB65C2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a193ec4979821efbe160abaf595e5dc6d22f46112bc385c80ee683375fc940fc
MD5 792c38c27a8a5ee3b84774eea40f2a0f
SHA1 ffcc8117ade7197965911cfcfd89738f97dc0816
SHA512 5655d21650fea6aaba3dd2949af2385e98e9aba925f912b3e7d445d6ce8dffd6b4ec889d37d29ac807735e5e24a4a6f639b25567e121fddf7cec94ab6a797907
SSDEEP 384:HZcItsNrA+OGGSgMuOoi0usyQIuIYXnsa+VYHGw6oJ:vtRUnC1TIxYXnhg28G
TLSH
T155827F725D78AC3B9DE3A680F64636139FB49127A6C53F44C5FC6F1D00EE6982306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 b0c2b822d459788e541f77e6ffb108a664aed0eb7a8f808e11523a47dc049521
MD5 94d2f785103587b108d8dae19a6ad0e1
SHA1 9808d6c41c9d4de5dd078f4251df9bea3d7af4c6
SHA512 b80f283dfc89ce91c41e06dabb7c0b50c0bed8e690279221f2b31ae5d8021440dfa4af18dd6f91d1fdf2a2e88f9e147a6a2947c9f91672a3d771b8ca1a249075
SSDEEP 384:DiFOZcIhbsN18TUNTUlIlA+OGGSgMuOoi0usyQIuHYXnsa+VYHGw6oJ:uFs9EwgKUnC1TIwYXnhg28G
TLSH
T19CA26C735D68D83BADF79B80FA4A3603CFB09167DA857E90D6E86E1D00EF1981306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3df7e39f09a265e139332e40c84b9427ca22c457634790f953bcf8d755e48134
MD5 68e10773ec2bbcb6f4d04d37026a416e
SHA1 147e0ba88eeb9db66c8a4c9e8371c4414e2e056b
SHA512 c212684260bc83412d3206178f000ae357f3818071eda5f9e760c232689216c56a40813944233c1c584bcd63d90fc409419145d2d3d1953fc8d48c1ac70b5523
SSDEEP 192:WONG6LPQmiUyYqNOgmSuOoiwoSus6LQdSuy7F0Yv/XFVU6:WONG6NiNOgRuOoi0usyQIu7YXnU6
TLSH
T1A5120A75A868F8279EA36980B28636139E715227EE853F95C9EC2E1C01EF55C230AD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87ca5951-29dc-4e91-993c-aeebaa2f69e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\87ca5951-29dc-4e91-993c-aeebaa2f69e3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 29b6ccddfbe975b841393302cc48a8310c726b3d284f572ac008615367b12d50
MD5 c3422c3c5b5be56f516333f448dffa18
SHA1 0284e2c0c1a853356c8eb2264ae4e72032e8aa68
SHA512 d0e7890030caa83e845212d969be86104a702784eebe65c36f9178c02c81651d27a471e590a7594483c1ad1b0afa646a271a95a4c7775c4a98455b2a5add4193
TLSH
T139412758BAF91148B3B7AF1A9BF6686E447B79772B06D45E00110E4F0B26B40C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download

MSI48A.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI48A.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 31bb9dfbca7cdfa5aa0085639775a9e21d72e29774736b1e21e3a2f31f0e2ee2
MD5 a8a939eda183d227bbaf556d6a8196c7
SHA1 c089ca163a3e1080e0d7dd4e8b39601df1bb40a8
SHA512 3a2ea55662e6f8177c5c7a7d05be0fe7b31acab6b99a64e212d08fcbd5be039e2e22fb1592fc53e5cc4223a4497b8e2bb996c183bc8c8552167a99001e9e39cc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d5286836adab6ba0658b668d9a4bf53546e255ed2849838ed6ef0b93247678c5
MD5 9e08f5c7477ef268663c4716262a2790
SHA1 19356054842f6aac12cce2d11bbba4ab6f39988a
SHA512 0b372425d8046c4fb76ecb512f440f0a4c31076ba067469c09f86a35707833734bea05f14242866902ca67f46757fa35d55abcc6be90596706c6f45f934b200c
TLSH
T136D0121E72A90576C01022730202730C0800C20B81094041942D9D2D9A140540A02482
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 606a9624aff183fd68c86002e6b9eefb2a3a4af6f0afded02df64997375860cd
MD5 34fb4ea6250efb95e4de6457dec1e625
SHA1 6512b154118882dee4a4981fdcb809a1699b0300
SHA512 71cfccd988ce485d15ea93f847fcd6b4a2fa0c6d3f6aa1a33fe9447b05ab74f55031dd3643254fece4965cd910ceb299138a6697ac0f16b02cd60c1191293492
TLSH
T157D02B6E327D0973C21433774281F34C5400C21F410A44405E3AFD2C8A400E10DC1982
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 fe60cae0ec353dd982119e6998deac5dd1a4aa448a907748dc1091e1d4aca36f
MD5 05b81a441bb0ef47bae811f43fa9e393
SHA1 5688df58969a6915fcc680f3ecb7e02539404c34
SHA512 1fc6b5904cd53c7d89c53fe6df62344ed9988b8c2fc28578a06932c99380a8a58e4c78b8501139ff2e87e4384e30e21e8ff79cef3ae08d5cac0ac57f94b998b0
TLSH
T1F2D0C0FD33192A33C324323381C1F14C2140C20F208E45595D35FE7C4DB889309D84C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f8fdb8e075958c7add309fecdea84b86c5e25e7048f9296e8237bf9df068679d
MD5 948448d1e6dbc1de098786823c02bc13
SHA1 359e417b3a987d2e8c0e6e532a2c5c8905781c1f
SHA512 ba82488d51cc9c00389990968c0fc3e888b7b9a61b20f87a2a8185801e90c4884898686d13018efbba48197f480781686faa58f90aadcfc28b174526e0069227
TLSH
T191D0C0FD33193633C32433338180F14C2240C10E218E46595D35EE7C4DB889309D84C1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 03eede9bbc416be922e098c22b1660e92b8e0e21921c9d7b522e8100de62c0bb
MD5 8658ceedf6b87daee58e6a7e307fe0c9
SHA1 401387776895729bb116b71adf7edf2726ed1468
SHA512 33b60ae39e84189d1e81f6158177f2ae7ac1dda2b12130d6ddd95f9e1dae5659bbaefd10fa6f6459e771e12da62ae57bc007d68d19dc95344ce032007db79605
SSDEEP 3:MsFlthltlluSwGCkM/lZrMLfB+MtcVnwxpnfK+1x7VclCi+kLil1G4Kt:/F8vzkM/lKcMtcNCuMLsi5K
TLSH
T1E8138C6DF2B10C17DAD93978D20A96B496A0A02C078002132121B02260CAF11C41B911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 275012aaaf90ed5f548574b159e8de1919722859e2db1c475c3fd181879ae04f
MD5 2bc6f7bc89a98a5b942e4d081b044e29
SHA1 b37745ac57deddaf7a69b9eca6e4c093dc05cf32
SHA512 6d4bbd94998f06837f0ca46bb21666896ee56b972a57702c6adb5b8d2a6883ac3a4c68efabc4c1d2e244d911374f5bdf9be38919908905e642e487701608f127
SSDEEP 24:Jm26hV11bh6b82WW3rOQUlbI89fuAT+RZ3uCt6P2Wcyk6x:B6hV1n6J3qQ+889fuATOZ7OXx
TLSH
T18E44D6CF1743D0C9C32282BAA6EE6A3FCA3F04E696D74683BD64CC685AD2B4D011070C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 6ad49c2c6a12ec02c58b5978e4c48a69bc8f135e56fb70324f5c2fab8fb96c42
MD5 4c52799921e69aba2805d07e15f528ef
SHA1 f28c4c627f7885343fec517bf139090f23808312
SHA512 6fc075f6e67822c3060b5723fc6522d8afa510cb06c489d02de518e8910f6e75ed528872f74829d171adeef894099f584c944cc9216a4dd86270e6046b2512c4
SSDEEP 96:DAVuI0dTYTdIO09uWVmJ+l+OqS6zRERX5SqugWAHo0ANDHvaBdIOSIaHqPfVXk6z:DMAUTdN0rVg+FqtougWfNDH9OWek6W
TLSH
T1F125F7CA5F3465A2DFE2EE71BCD5C8153EF821C4BAE6A083448286BE64C37C52A5650D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 4c7ba5f52fe2d2664d3fa99d8dc2fcb476c2330e4b22cbd8408ab0ff54d880f2
MD5 e2e5ce1c971da9defbde6290f6be8646
SHA1 58db3f4ece53a3c0ebe7d046636ff00eebb5cee6
SHA512 394512d41dad0b6000a61ae6d68c5f996527358167c53cd09f1447cc974a1fd23075b8a6ba219a3acba388e1e2e127cd3c6107d71317fcebfcdb4697f011c803
SSDEEP 192:fG6DbeRyE01uPl7VAu+ayEYh/a3U1Pl7VAu+ayEY:fGgqAELQu+JEYhP1Qu+JEY
TLSH
T16C162BE70F74E906EE51EF70ABC8DD2C3CB057A67D879892B50A81F518E0BC01B8655E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Cache\Cache_Data\f_000001
Size 873KB
SHA256 c946a53b835148cac56c71b85678f1b7637bf18635b8ab246fb7bed3e88f3691
MD5 e907cb3f1181c72782e36cb532cf9d15
SHA1 68e2b169dce806b0228bdd713520a08eeab8fea8
SHA512 85e97430dade8c3394629c0f381d760cad6dbd5db2d9beeba1fc6bcfe29fbdf71261f219fba4a23b256d91bf15319c703ced6c3f980404faed5c586a2eba7c85
SSDEEP 12288:lVJoF2Uqn3EaT/F0h1x3+QmFJt921HET8kdbbwYU6L/cdeg96YB1cIYJ9JFZ3Tde:l8G3EoNE1q9eH48kdPH9An9bC7ZTbDjI
TLSH
T141152353AC97ABF88E13F0718FD62A83160CBB1B6F9883404870CD9E557535BE425BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Cache\Cache_Data\f_000002
Size 32KB
SHA256 fa26406eeda9a3c6ec3d9ea8813c3045d6dc755e30c716d5c094e8ef43be5a7f
MD5 0d0e5e4d2f9fef29f3aff5e8e0e659c4
SHA1 93f322133a56cd58cb13fd9d3e3555426875e255
SHA512 5b62778ffd0054b895ddb493ff46f760f96d0dcbc6e171466ea5497c02ce02c7a12238ebde1e73c7e95530634a0eab7fe1c4f1ca9d24f6f54cf6a9e9d9bab9f2
SSDEEP 768:ROxePX1Sw4LXk9Hj8lO1W87tUx7HfPrKF5:RBdS7jk48W86xL0
TLSH
T164E2F15D7D932490C4B41899C6E20E56EAC508E1BAD5EAD3FF1B0D0EB71A4F4CE4E1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Cache\Cache_Data\f_000003
Size 2.4MB
SHA256 bc624c0686891cce8151ca0c16fd95df17d8da61600d7d401c608aaae2c0d51e
MD5 9c6921292a7dc79599d5d9ab5bd290bc
SHA1 f9f593159df84338375e25265bff605bd515aa44
SHA512 0bb8d2dfaad915ee72d876494533eb7a8e02b2b25c45522f917c92e317de62422924536f03497c4db4072ede1ae46a380e183f11d7f543bbbd53d3b4bedc4fe9
SSDEEP 49152:CtKyXjN0lLaqyop8LOx/VHKfZGrSABmYbcDnc4UaTAFi+WUwGfnOyHF7oxRxoVkC:e3B0lug6y9VHIvAYYQDc4UaTAFiCfnOa
TLSH
T122B5331DE6FF12AC8A6B50C4C24FB61450D2FEF2B6347D9E996BE3B0F3765992811600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 fdb6363cb3422e4fd31fa15ed09af3097d674e0e26e35db63d95f4161f0be003
MD5 25b47065dc75a32f553c043308164e18
SHA1 feb84477ebb733c137c658ce60c631628ed049f7
SHA512 971b8e36d19d4cbc0bd0be8f9892462fea35b61197cb242f2db23f8f9a2edf27b7290cd652b5acd28e939adb3f2e935d1d819d383666cde1e17fbdef88f697dd
SSDEEP 3:LsYllNlNllkll/lniKMJDllV11nMsl/u/lcE/Dl:Lse3lEtniEslvE
TLSH
T1C344012C8BA0090FC29416F980838B75572DC108AA9B93470248012578957810E1A180
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 126ad0538c607c1aa1114ab55cfae093a4a4fdb31a25a1a0d83f31871a55ccc7
MD5 a4de3cd7681442415c269528b0c93186
SHA1 b10fd529a103f5adc148c7060f7c7d3d9fd57d58
SHA512 492a09284896070f04ce40526497b9808b001cd68a1c18f0b07aa6c793c9e87c3edde4cde4354f8d9fbbb562423fcc0789ec2df59bf2fb52d6a362bbe98efe58
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 d394187ab59009a101d2618a16a29e46819e2eaa694114b21f9bf8b1ac19be4d
MD5 fc234165d422f109f45f3b532528308e
SHA1 fbdfc3456daa7fce027f034aa73c8d54d8348c42
SHA512 fa6df8639b855524a86b8d7decde112d9a4de58a8e8c5f8027b0ebae0084edae80f4f9a4cd7055278bd8f6c3390a8b8ab21a0cb3e206fe023ab3a7b84ee395e8
TLSH
T10BB022A8BCE2000AFBC033B0B0CA023033328C3C3B83302080FAA030ECB0F8C0022000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 20889dc08cb3bc2a5e4e6bd20c6a1787148c7ac58cf6d2ef7360fa966c7eda48
MD5 b4df33c6df1ff421952400a02d83e994
SHA1 71f1516ac0f19fdef52220b95ab65b6e9dc590dc
SHA512 d2cae5913966c8e1a95092536b1a65ffe7634d8832dc95799e66d59c24cbe6fb7e0eaa118916dc536397af85d42cc984ccd6d0ca7a10419e1f25e4ba89eaaae9
TLSH
T11DA0029C0E941452F2C5237415C60371B230C83D86571B1682D500B4D870780C111209
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\History
Size 184KB
SHA256 44ee4c690ae4e7bdce44084469ace51490ceeab73d85074a0db92022be9a815e
MD5 a7a457e148de858dcae35a34e825e5fb
SHA1 43650ed171e77a638f3ffb2036f2c13532f58a14
SHA512 5198236e8e354a89e75d87753ad50c710de2887d32b5704345707f1db20a22b907905c45652a826beb0004dcfd2d066dc1c26b4268d1937d8c34d157facc058c
SSDEEP 192:HBNQPH+bF+UI3iWGV/WN3qL/kcVgZQW3/V:hNQPIkUI3ijV/WN3qL/kcWvV
TLSH
T1C304FD1E5F343212CDBD923668E645B3597DF02F8B136AD66C6104B1CEE2652B02C5FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09a8674e-1615-4a37-aaaa-d4768bfc5d31.tmp

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Network\09a8674e-1615-4a37-aaaa-d4768bfc5d31.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 fd3826b1fdb7412a78f22c0b92bc5d869fde95a186285daf78c495adedc117a8
MD5 3274eb6f1f66874f4dfc7e1c7b9e2332
SHA1 49ffb0fc3f6815a2dd9fd5e6c7779810d574692b
SHA512 9d2b1b8508494ee22e4aed87369328e0d1f1982cdd56daefe7aa5d4e0ba8cf0aa64dd32e53045add7de254a35a2da48da0c4851d973c6403d5073458163eecac
SSDEEP 48:T9LopFMatSaw/auUOt8BW++o4MsQXphdBH:NeMatUaAKW4sQXpfJ
TLSH
T18892414E1F303221C0F54B3BDEE445A62FBC116DC3A726899E1020F3DD9295BF60546A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 63727817fd75ab80f161907b69138831bb2ad4043d8319b8995578f227dce717
MD5 5691752f0fbb088badf72e17e933dbf4
SHA1 9a6ce1a095364172bf8f9ca2f32f77c691854280
SHA512 75e2bb81d3ba22a4afc15b9c422716ac1e1f7ccb348dc6e50b06faded35d212480244c5825e27f757f02afd6fc28131d016cbd7f8f1ca9b76152a1d38e17c601
TLSH
T13831A2E2C7D4C66D8E412AF427347817CD6E051992243D27CDEEEBDA67D14B1D22150F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a370f.TMP

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Network\Network Persistent State~RFe5a370f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 bc8939e7c7b4eb00d0de048508dd4d0418fbd6cadd09ed56de6268e2cb1e0990
MD5 302d709664266ed1be12d1534af5497f
SHA1 553a1aa9f04000681f90387a32c5b2c90c857395
SHA512 b89fa5d332be1f9838abd87993e5958e0e8821117cb358c41f7fdfbbb90f7afd06ec39a9d38d5f07d614bf71e9185049bf89a2e2872eae9c16609626cf242a53
SSDEEP 96:uIEumQv8m1ccnvS6475Had6wH9Ld0RK+uq:uIEumQv8m1ccnvS6IK6A9B01
TLSH
T1C3F264BE0B14F308C4A46934E654188BFD76001E9BA6DEA5AEDA97F1BF860F3F134505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 becb6141eb57c97a4b031302f9f43537beec9a6615300adeace3b6398920adf3
MD5 7563d23f97e8259b1947b3652ca72453
SHA1 bf3482bbfb5c5766d102a324278a6444ca3b3bbc
SHA512 7f758f88a8a606a9af6eed7d6e48efcd8e5ca758c4062c5fc289d03e74174b01f734093e26c488a2d13428afd52e8513e6cbae6e13e848bc54497d6f48cd12a0
TLSH
T1C9F024DA817EB177103C097A2C407C552FBAE139015368E5D94B41AC60C49B78512523
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Preferences
Size 7KB
SHA256 045ae3472b2097f467ed5094df47f52731efb3b4dbd9031a1b8e1a6f25241509
MD5 cc545f23293af9a43c5e9f0ed3a019cc
SHA1 5614096ef7988a035fff1ab534cc180701a77818
SHA512 190ce6f233031e30315428e829a49d2cb3c6a27b13dc9315ab55b025bb8341a8521f81303b23ddce55ffd9bfc4d681c8919aad2e1d48c17c4a129306f8179a33
SSDEEP 192:stsrRdf3Z8paB4/S+WiT17axBVX2+5mVPMQ:stuRdOj/VNaxSkQ
TLSH
T119F1B8169E38697B4CC7E51D7A75BF52E2F9502272C10E89EBFC861C04DA6CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Preferences
Size 6KB
SHA256 641056fa2eec150183de2fffd8621b98885352c7ec3f8e2fa2f1acc2454d057f
MD5 b83c4b7537811c6b15cb698e34262b71
SHA1 5943a1131e473c89c9437b12c779a119e34cfc5a
SHA512 4b4d049c5e1c70710c9e2eb6083459197a0d98ef76373009168b5f4731b17b4c58c47c5a87a256223255b320b1b2fa3c8ee02b72e58993d16676a71bebd63aaf
SSDEEP 192:stsrRMkfsZ8paEf/S+WiT5PqxBZP2+5NfMO:stuRMkr3/VZqxCO
TLSH
T161E1A8129E3879774CCBE6197A75BF56E6FA502121D50E95EBFC871C08EA6CC220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Preferences
Size 7KB
SHA256 c10522324bdc0d470a25988c7169b8480fc35f0b0ba1ba0c2d110c0b6781d853
MD5 eb5c8c4197a5dace987cdf567e78f852
SHA1 d1ce5ef1f7a6abfa9c8b1d9f73e64f43758f1bb8
SHA512 9bb4b133643393d5969bb53ae9031697f0ec3318fee6bf583886a57de1f356d2ad03a2f8a5f1eaa4c51f62a98c6c3d51c5994b09bc6006b2649f5e0dacc0c6ca
SSDEEP 192:stsrRMkf3Z8paEf/S+WiT7JCxBZP2+5sVWKQ:stuRMkO3/VBCxIdQ
TLSH
T15AE1B716AE34697B4CC7E61D7A75BF52E2FA502232D40E45ABFC871C05EA6CD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59f88f.TMP

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Preferences~RFe59f88f.TMP
Size 6KB
SHA256 28aa50bdd8a15958e2a5b508cc1187a828a5487a1d2a23cb0f2c6adf97253c06
MD5 8e95f5c8f4eea9f90decd387666fef2a
SHA1 31af798afd7565b154eb7417f8dac911fc07d6d1
SHA512 1b81e8645c536351e940d3992fca2b7f6cce7273f8573b04173ff9da2ace5700884ddfb3dbb8a5df13ae77abe078aaae641284c8a90011ffca06daa26fcd1862
SSDEEP 192:sts0RMRfsZ8paEf/S+WiTm0wxBZP2+5+fMO:sttRMRr3/Vpwx5O
TLSH
T15CD1B7539E3469774CCBE61A7A75BE52E2FA502131D40E45EBFC861C08EA6CC220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 a708898e9ae5f356daebfa22d1d81fa55ab75609ff91c4df8a54c6581b5a7646
MD5 7a55b6cd0bb451f813e6028fe7159d51
SHA1 2e747a90fc6a74963066988aaed0d0610cd49353
SHA512 5fd7e81f1f177ee86f6d3de3945163e761ca2886c1a62f2fe1059f9af37cfeb80ee657c6a962d25f4c7f92d9ba055eb1d3f5bc06d04ac683ed2882df57ef11f5
SSDEEP 96:Hl5izPlf/ROoKOpkF5d15ie7sMaTEv9V5h5pg5+eeQ4FaQAIz2xZ4ER4KQ:HurWG9G9l61Rv4W4L
TLSH
T1ACD1D4A7452DC474AF444AEAD8393ECBDABA409F98D5484A97E2C54807C2FFC21CE4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 f56cac36e53dd583138159abcba9dd2e11d49c2986d4085476fc7bf51526e0c1
MD5 b306cb47959b1a1eb1c7aeae5ca8d649
SHA1 17d72fcd27ac2c4480fb45a2808d47348c0fec9e
SHA512 8fc21956976b7182481419e52019d6a9cf8043c91343e26614b2202976b212badaca8dadee163bd1c5c8e8a70f53143921361d37134941a8d8c952e3d6b78ea3
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Local State
Size 1KB
SHA256 b7d84c840e005f4c4e165940624c1b6549bdfe4f1c48f1fabf0917c867748499
MD5 ba4eaa25d329399b27686bf941b3166d
SHA1 b048514f3b9e46d2de60da66434ca84a61c9eb03
SHA512 0853da1b9185a8d95b00985e06b11c675aacdab8aac98d52c74190514a442f8e85ae5295b03dfbbafd3c9e03bc565b9cddd881bd52abd8ddf4ad7e8bac3051fc
TLSH
T1E931B7B3D8A07B724CC2946372427F87EE31902A71904F4495ED4B1C11EB3ACA15AE37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Local State
Size 2KB
SHA256 55f13dde6623599c92f97743acff54c7bac45912a427133b9895026c1cded1f8
MD5 e7e97cde9c9fe52d4877cf776dcf48ad
SHA1 ec8e7106409fc06fe17140e4d90d447fc4d4b27b
SHA512 b760dcfd41eae854c0e4a3bd5b7bf7ea285097fe027907f101fa442e4a42059f79bb507308e34c2f900674c57d14bbcd6f89f209bd34d5dc3fcc888d079e823a
TLSH
T1B051B673AC24BA3348D38955B5463F52EF3690666A912F5099ED0B1C01DB27C2342D2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Local State
Size 3KB
SHA256 baa552af4d71a70e9cb30418fa62ab6af6b9465ae9e4e026ea579d89989b5934
MD5 aba0436f105fb55e1eefd8f3e1aeadba
SHA1 2380ea59334a570927b5844198c62cfc21316fc4
SHA512 d14684a9b3a9d586f805fed6e6d16d64949a170d0561ccfb2239e6578bd8ae61c5fdad7860baaf06690816af1c4647ad82a711a3c215b5203e4ca76e2b0f3e0c
TLSH
T140719436A964B9374CE39911B9852F06FBA59127E5D43FA5C9FC0F0C01DB3A82342D1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Local State
Size 16KB
SHA256 344b0f4bde79df7c3574b5365de304feb245f58465c5fd13fc91e8711c4cc58b
MD5 f85af6298745011ae94902fae422647e
SHA1 2fa56879a278a2149a6d2b72a15f9e8da22b474c
SHA512 49cf0c8b8fa106186265a1bac28a402abfdaa8455f9a0ba31d26714095d232365abb1b78f323c8f64504bf725104c3d62245cad1a8dbd830144d57302b10c998
SSDEEP 384:zT+aQikB+z/xvxjg/qhEwNb5Eo9sJ6JBSbB9zb:+/UxvxjgC+bmsJ6JBSbBFb
TLSH
T1C8729E3B69393E2799F7A50575480F8BEBB9D0A690C16EA44EFD0F0D06D73A81342D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Local State
Size 17KB
SHA256 8a3aa0296d72ffd3366439b0bca88ca9a5dd33c98ec14161ea327d1d56dd1ea0
MD5 8c3d74072def2b90a0b68a9fb5cddef2
SHA1 2c9399f46bb6b46e3270015b8b2d75f1d82c36d1
SHA512 75b7070d03119ffc2fe829f9b827e5028171e3e3577e70e97b59721e8cc78c2fc52e03b5907b1bfe64797983018ff864f15ef8d17c0363819fd6525260e6338d
SSDEEP 384:zi+aQikB+z/xvxjg/qhEs3Nblgo9t36JBSbjukDzW9zY:x/UxvxjgC+skmt36JBSbQFY
TLSH
T154829D2B68697D6798F7A40576580F8BEBF980A290C12EB44DFC1F0A12DB7A41343D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Local State
Size 16KB
SHA256 7a12f83785ec73b232694eb9b7578bda84d506f4de4ce51798fefc0c94a0cb5b
MD5 2d6cbd896f736c682b8cb4ca9d60f1cf
SHA1 038e49fa46052cc9d4e024d2ba3477959e7bf198
SHA512 7c1effb1be3d0cc1570b3cb47abba2e4be6d3335126f1aaff3476e096656fd2e945b177c30071be3582207c107cff360abed19fb534f60b3b5629aeb0cc25004
SSDEEP 384:zs+aQikB+z/xvxjg/qhEs3Nb5eo9sE6JBSbB9zb://UxvxjgC+samsE6JBSbBFb
TLSH
T18D729D3B69797D2798F7E50575480B8BEBB9D0A2A1C16EA44DFD0F0D02DB3A81342D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe598f55.TMP

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Local State~RFe598f55.TMP
Size 1KB
SHA256 fb07e666b438b572e12c089cc5587a95634aed344782ef493dddd769db731450
MD5 3bd0302da3395936d5fe55c7ca3afd17
SHA1 91478a1ddb141f47e52c95efa48493d2d26d56df
SHA512 c7a48bef7ed21a9712e8603f60e531d0169ad219734df196511fe8de5d52a5bb5b477234931f4659f0daf4406fac227415e9e68b36ea73c148845876321902e2
TLSH
T1FE21BA73C8547A724CC24832B242BFC79E60D06A71904F04D5ED071C11DB6BCD256D37
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 71f966d864fe76225cb47929427e303fad37e33c0c1f474d44edf215ee9a5259
MD5 af5ed572ec7fed84ede92eaddb6c56f9
SHA1 eed8c6a0538cf1a06d4593dfd0101760f6301481
SHA512 c76b611842f0d991ece29965615735b2653a44ce81002e3ce7990c3e835110a389e3fe6683356e8e51a550603ec76fe3bac1a5e5577e294bbc1beab50951f798
SSDEEP 3:MsEllllkEthXllkl2zEklPol:/M/xT02znPo
TLSH
T16944041C7FC10405C70431304011C7550371D434151357433451C5135CC5FD10D01003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\ShaderCache\index
Size 256KB
SHA256 0955c914808b1360b873380440b2c8e69b05b066bc016e2d9c1c5397faed65dc
MD5 559dc4e14bce7babb45c7af91fbb1281
SHA1 2c6fffd8c83dc3409ba66e435ba60a27c2fcaf76
SHA512 b42593a2015c2577a58320a6c62742758a3366af573d0ed584ba242235e62a416f31ddf164ad8b238262379c04a6aaae85f261890a35c44945c3f8b6ae8e2892
SSDEEP 3:LsOllllklkXlm/l:LsUlPm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\diamond.launcher\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

DiamondFN_1.2.3_x64_en-US.msi.crdownload

Path C:\Users\Admin\Downloads\DiamondFN_1.2.3_x64_en-US.msi.crdownload
Size 6.2MB
SHA256 1e7adb9b8fba94f4512b84d97a667f365c01d5a70b97b72eef494e2f4b6130b4
MD5 3d5feb8728208c9325c9a277c87a2b96
SHA1 c8dc43d1ec4a7ec99d37d6100f49701dec6b1a6f
SHA512 3b232a802ab76e2452b4f8923fd5ba12d992eb3007c828e527cf829752a0e78efad03e04db0e3fbfc64500906cbe90c0cbb2359a611546a95fa29468ff6fe253
SSDEEP 98304:ZZJpa5WuHcGQ2ppLHPuvKTvYQhWhJwYeR3O3yTvKAsvGXgReHT+T/yF6xb5cO5E2:TEWScf2ppb1QKlFTy7GXr+TntcOEsDP
TLSH
T1C166332F7D85AD52D96A0D76947287500338AC104B6184F3BAC7BB2CDFF12C05E76ADA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiamondFN.lnk

Path C:\Users\Public\Desktop\DiamondFN.lnk
Size 1001B
SHA256 7339379a7e36cee16c6abb7ee2e95d1867c097626744df0356835b2b55172393
MD5 ea7d7b0979f0b09b8b8d951ca5c18f1e
SHA1 95d70176efa0b36d8da85770e8340cda00ad605a
SHA512 13f20786932b8cc7dbbec22eafed318f1d6c61083228a40ab06528e263e6fb1dd46f6e24d059b93c14cc931620c40f68d1432363cdf0ad656fe8c5075b14cb1b
TLSH
T15311882007EE1399E2E38736A71A172107327E02E2610B7A80E9A9964C54A948579F77
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 f4039fbdf89a7c5faa6759e16e6ca4c822a7d078cf03f0eab9b3f5f7484178cd
MD5 db91ad7b0bc523549b784720ea286c45
SHA1 bad59c7a95116a3352b45cd5d0015954d3fb0953
SHA512 e79203f99484783120d050dfb3cdc5d2b67625879d0cc596a94feb22e172c3bd6971c32bf9383e0891235d99d5c60d9904bbf8511debff0623e5628cf04b64ea
SSDEEP 24576:KEpmg3MKdoO/vvTLzX1efpWb987h4tqjJF4tjD5n8QqDZmr14wW2QJxOzS:Hc
TLSH
T11E47F46436F92110F7F39E3CA8F06A274A397D5B9C15DE8D45411B8E0821BB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{564de7ba-08e5-4e37-9273-0b6c53f3598f}_OnDiskSnapshotProp

Path \??\Volume{139eaa61-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{564de7ba-08e5-4e37-9273-0b6c53f3598f}_OnDiskSnapshotProp
Size 6KB
SHA256 debe9633b323cab0ddd39c98d809214d358bc09502c3ab6138b8ae169b6a8226
MD5 93f6cf63c3d89773b764661342278c2a
SHA1 de22ab062f9a6082a3c4d371838808e0f65a379c
SHA512 08b7b7f115ea1c5bcc2a64e0639af1107c045fc4bdb8c9893b7df1bdf2201a4db2a58938758339e4b5158c701b3b225d06022d6d0f3e6def7bbfe90750f781b5
SSDEEP 96:FHCalQmYvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:AOQVb++ZVmN
TLSH
T1DBD18A085AF54311E2B3AB3129F14557A477B811EF33CB8E0198638E2670914F876F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5612-304-0x00007FFC05F30000-0x00007FFC05F31000-memory.dmp

Download

memory/5680-333-0x00007FFC07CB0000-0x00007FFC07CB1000-memory.dmp

Download

memory/5680-332-0x00007FFC07240000-0x00007FFC07241000-memory.dmp

Download

memory/5848-334-0x00007FFC05F30000-0x00007FFC05F31000-memory.dmp

Download