d0f376049a670b77a28f208cabbee0974de5a88d8644d07b5bf7786580f566ec

Analysis

user interaction
yes
max time kernel
900s
max time network
899s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tah.py
Size 2KB
Sample260925-ttdxcs1blb
SHA256 d0f376049a670b77a28f208cabbee0974de5a88d8644d07b5bf7786580f566ec
MD5 73803c3059511790a88f9225c11d5ae5
SHA1 d524658db8ea6ef3ed69f9a1aeda2ff689448119
SHA512 b9bf0904d4355ca8c69e85b262d3c1d5a6b323d8045ca9fcc57ba9a0e0875ea669c0651318d2e6c0ecce413959374944b58ad1a73dc9dcf16bfd58335590b15a
TLSH
T16941CE518813910AA534684A6F933708F38792A345F155173BFCC368BFB4A23D65DBCE
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
207	3612	chrome.exe
285	1276	msedge.exe

Executes dropped EXE 9 IoCs

pid	Process
3052	rans0m.exe
4856	windowsdesktop-runtime-10.0.12-win-x64.exe
2744	wixstdba.exe
2708	windowsdesktop-runtime-10.0.12-win-x64.exe
6988	windowsdesktop-runtime-10.0.12-win-x64.exe
2796	windowsdesktop-runtime-10.0.12-win-x64.exe
5384	wixstdba.exe
4876	windowsdesktop-runtime-10.0.12-win-x64.exe
4100	rans0m.exe

Loads dropped DLL 64 IoCs

pid	Process
7112	MsiExec.exe
7112	MsiExec.exe
6160	MsiExec.exe
6160	MsiExec.exe
1048	MsiExec.exe
1048	MsiExec.exe
7140	MsiExec.exe
7140	MsiExec.exe
3888	MsiExec.exe
3888	MsiExec.exe
7140	MsiExec.exe
7140	MsiExec.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe
4100	rans0m.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2} = "\"C:\\ProgramData\\Package Cache\\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\\windowsdesktop-runtime-10.0.12-win-x64.exe\" /burn.runonce"	windowsdesktop-runtime-10.0.12-win-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
	\??\F:\	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\darkred_wallpaper.bmp"	rans0m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\kvkQg.jpg"	rans0m.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.CompilerServices.VisualC.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.ServiceModel.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Private.Windows.GdiPlus.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.Classic.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.ServerSentEvents.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Windows.Primitives.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ja\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Transactions.Local.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\es\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pl\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Resources.Reader.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.Serialization.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Security.Cryptography.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Security.Cryptography.ProtectedData.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Text.Encoding.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Text.Encodings.Web.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\UIAutomationTypes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Private.Xml.Linq.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ko\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Reflection.Emit.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\Microsoft.VisualBasic.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\Microsoft.NETCore.App.deps.json	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\pt-BR\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\host\fxr\10.0.12\hostfxr.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hans\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.Security.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\de\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\fr\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\zh-Hant\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Net.Mail.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PenImc_cor3.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\PresentationFramework.Fluent.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\it\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\10.0.12\ru\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\10.0.12\System.Text.RegularExpressions.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7905.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8098.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF48F5B3168D1027A8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_622142344\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_524569513\extraction.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_906015498\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\Installer\SourceHash{17D94539-A423-48D9-BD4A-69A9186C5B66}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5D48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9924.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_1023637875\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\e605ae6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C5D.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8A3AA4A348F80293.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF62BB5402FD901EA4.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F6E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_1023637875\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_279145393\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFE4C23327C5151BA0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF85C3360B0E9ADC63.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9664.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_1738232872\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_622142344\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_906015498\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_906015498\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_906015498\manifest.json	msedge.exe
File created	C:\Windows\Installer\SourceHash{E358F0F7-0226-419D-85E6-D45A08BF195F}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_1738232872\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_622142344\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_524569513\automation.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_279145393\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\~DFC4DACFE03EDCBD75.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6338.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e605af2.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1E0D2666F3E3E0D5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4C9828EB5E75BE5E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F80.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_622142344\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_524569513\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\Installer\e605aec.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF25811BDE57B14D4.TMP	msiexec.exe
File created	C:\Windows\Installer\e605af2.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{902710DF-F5E0-42EB-8959-ECC10CC368DF}	msiexec.exe
File created	C:\Windows\Installer\e605afb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C05.tmp	msiexec.exe
File created	C:\Windows\Installer\e605aed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6122.tmp	msiexec.exe
File created	C:\Windows\Installer\e605af1.msi	msiexec.exe
File created	C:\Windows\Installer\e605af7.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_524569513\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDA9F24BEBB47074C.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFE3C808B2D20A4FC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67EC.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7027E00A84EB8261.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBE582E725A84AEE5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF889F2F29D4C91220.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\91F309C43C4BC0D4C89C4D445C11FAC1	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0C9ABF0A15E260A1.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI623D.tmp	msiexec.exe
File created	C:\Windows\Installer\e605af6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e605af7.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF853FB4FF7F62EA1.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9E436617126B335D.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5388	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-10.0.12-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3612	chrome.exe
1276	msedge.exe
5084	msedge.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\DisplayName = "Microsoft .NET Runtime - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\DisplayName = "Microsoft Windows Desktop Runtime - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\93549D71324A9D84DBA4969A81C6B566	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\Version = "1345381484"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\FD0172090E5FBE249895CE1CC03C86FD\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39\Provider	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\GoldFile3\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\RANSOM\\Icons\\gold3.ico"	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\GoldFile4\DefaultIcon	rans0m.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{AFABC2D0-DE0D-45EA-9B20-8C1091C862E3}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\PackageCode = "A67E422DCB5A6B244B1F3508AB24FAC5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2939A0641A55C25433FD7E322A7159A9\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\GoldFile5\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\RANSOM\\Icons\\gold5.ico"	rans0m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\ = "{902710DF-F5E0-42EB-8959-ECC10CC368DF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\ProductName = "Microsoft .NET Runtime - 10.0.12 (x64)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\ProductName = "Microsoft Windows Desktop Runtime - 10.0.12 (x64)"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.gold5	rans0m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\DisplayName = "Microsoft Windows Desktop Runtime 10.0.12 (x64)"	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39\MainFeature	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.gold2	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\GoldFile6	rans0m.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5840E2420625E5A4B03C0089F5778860	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\93549D71324A9D84DBA4969A81C6B566\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\245448558535FDC5C8905F329F49898C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\ = "{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}"	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_80.48.58476_x64\Dependents	windowsdesktop-runtime-10.0.12-win-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{E358F0F7-0226-419D-85E6-D45A08BF195F}v80.48.58476\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{E358F0F7-0226-419D-85E6-D45A08BF195F}v80.48.58476\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\.gold3	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\GoldFile3\DefaultIcon	rans0m.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\CrucifixFile\DefaultIcon	rans0m.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\245448558535FDC5C8905F329F49898C\7F0F853E6220D914586E4DA580FB91F5	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7F0F853E6220D914586E4DA580FB91F5\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64\Version = "80.48.58476"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{8C704AC7-A0DB-44DD-A1F3-F0FBDF1FF693}v80.48.58476\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{5B5B51D5-E8A8-47D9-981F-83FFCB8E2825}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_10.0_x64\Version = "80.48.58476"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\93549D71324A9D84DBA4969A81C6B566\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\FD0172090E5FBE249895CE1CC03C86FD\PackageCode = "1996005C24BB6ED459236374EB503368"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_80.48.58476_x64	windowsdesktop-runtime-10.0.12-win-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7CA407C8BD0ADD441A3F0FBFFDF16F39\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_80.48.58476_x64	msiexec.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
5700	chrome.exe
5700	chrome.exe
3996	msiexec.exe
3996	msiexec.exe
3996	msiexec.exe
3996	msiexec.exe
3996	msiexec.exe
3996	msiexec.exe
3996	msiexec.exe
3996	msiexec.exe
3996	msiexec.exe
3996	msiexec.exe
3996	msiexec.exe
3996	msiexec.exe
6672	msedge.exe
6672	msedge.exe
6668	msedge.exe
6668	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
820	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe
Token: SeShutdownPrivilege	4240	chrome.exe
Token: SeCreatePagefilePrivilege	4240	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
2744	wixstdba.exe
5384	wixstdba.exe

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4100	rans0m.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe
4240	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
5340	OpenWith.exe
6632	ShellHost.exe
3996	msiexec.exe
7112	MsiExec.exe
6160	MsiExec.exe
1048	MsiExec.exe
7140	MsiExec.exe
3888	MsiExec.exe
2552	ShellHost.exe
7140	MsiExec.exe
4100	rans0m.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 2176	4240	chrome.exe	93
PID 4240 wrote to memory of 4016	4240	chrome.exe	94
PID 4240 wrote to memory of 4016	4240	chrome.exe	94
PID 4240 wrote to memory of 3612	4240	chrome.exe	95
PID 4240 wrote to memory of 4140	4240	chrome.exe	97
PID 4240 wrote to memory of 4140	4240	chrome.exe	97
PID 4240 wrote to memory of 1084	4240	chrome.exe	99
PID 4240 wrote to memory of 4852	4240	chrome.exe	98
PID 4240 wrote to memory of 1084	4240	chrome.exe	99
PID 4240 wrote to memory of 4852	4240	chrome.exe	98
PID 4240 wrote to memory of 1128	4240	chrome.exe	100
PID 4240 wrote to memory of 1128	4240	chrome.exe	100
PID 4240 wrote to memory of 2248	4240	chrome.exe	101
PID 4240 wrote to memory of 2248	4240	chrome.exe	101
PID 4240 wrote to memory of 1220	4240	chrome.exe	102
PID 4240 wrote to memory of 204	4240	chrome.exe	103
PID 4240 wrote to memory of 204	4240	chrome.exe	103
PID 4240 wrote to memory of 4176	4240	chrome.exe	104
PID 4240 wrote to memory of 4176	4240	chrome.exe	104
PID 4240 wrote to memory of 1396	4240	chrome.exe	105
PID 4240 wrote to memory of 1396	4240	chrome.exe	105
PID 4240 wrote to memory of 1360	4240	chrome.exe	106
PID 4240 wrote to memory of 1360	4240	chrome.exe	106
PID 4240 wrote to memory of 4332	4240	chrome.exe	108
PID 4240 wrote to memory of 4332	4240	chrome.exe	108
PID 4240 wrote to memory of 3168	4240	chrome.exe	109
PID 4240 wrote to memory of 3168	4240	chrome.exe	109
PID 4240 wrote to memory of 5888	4240	chrome.exe	110
PID 4240 wrote to memory of 5888	4240	chrome.exe	110
PID 4240 wrote to memory of 548	4240	chrome.exe	111
PID 4240 wrote to memory of 548	4240	chrome.exe	111
PID 4240 wrote to memory of 1536	4240	chrome.exe	112
PID 4240 wrote to memory of 1536	4240	chrome.exe	112
PID 4240 wrote to memory of 4544	4240	chrome.exe	113
PID 4240 wrote to memory of 4544	4240	chrome.exe	113
PID 4240 wrote to memory of 4528	4240	chrome.exe	116
PID 4240 wrote to memory of 4528	4240	chrome.exe	116
PID 4240 wrote to memory of 2720	4240	chrome.exe	117
PID 4240 wrote to memory of 2720	4240	chrome.exe	117
PID 4240 wrote to memory of 5836	4240	chrome.exe	118
PID 4240 wrote to memory of 4880	4240	chrome.exe	119
PID 4240 wrote to memory of 5836	4240	chrome.exe	118
PID 4240 wrote to memory of 4880	4240	chrome.exe	119
PID 4240 wrote to memory of 4088	4240	chrome.exe	120
PID 4240 wrote to memory of 4088	4240	chrome.exe	120
PID 4240 wrote to memory of 4188	4240	chrome.exe	121
PID 4240 wrote to memory of 4532	4240	chrome.exe	122
PID 4240 wrote to memory of 1992	4240	chrome.exe	123
PID 4240 wrote to memory of 3872	4240	chrome.exe	124
PID 4240 wrote to memory of 2756	4240	chrome.exe	125
PID 4240 wrote to memory of 2756	4240	chrome.exe	125
PID 4240 wrote to memory of 4312	4240	chrome.exe	132
PID 4240 wrote to memory of 4312	4240	chrome.exe	132
PID 4240 wrote to memory of 5700	4240	chrome.exe	133
PID 4240 wrote to memory of 3052	4240	chrome.exe	134
PID 4240 wrote to memory of 3052	4240	chrome.exe	134
PID 4240 wrote to memory of 2720	4240	chrome.exe	135
PID 4240 wrote to memory of 2720	4240	chrome.exe	135
PID 4240 wrote to memory of 5920	4240	chrome.exe	136
PID 4240 wrote to memory of 5920	4240	chrome.exe	136
PID 4240 wrote to memory of 5156	4240	chrome.exe	138
PID 4240 wrote to memory of 5156	4240	chrome.exe	138
PID 4240 wrote to memory of 4760	4240	chrome.exe	139
PID 4240 wrote to memory of 4760	4240	chrome.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Tah.py
1⤵
- Executes a command shell one-liner
PID:5388

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffddd1dc728,0x7ffddd1dc734,0x7ffddd1dc740
  2⤵
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,14760976510654479804,2176598005831794655,262144 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,648705639170371820,11667847042722470670,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,1067517881409124900,16276577458696700685,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:13
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3304,i,8832751135739878031,16658259555633020235,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3280,i,11018652964746955888,17878649065421206368,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4732,i,16269772780106568094,12840793705965864310,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,266951555544096748,9564473973868169224,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,8486420934055346805,8762713390683915655,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:1220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5448,i,402480240871984910,11755882325413103489,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5480,i,12038084735030134399,1567934742713105741,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5640,i,6538212085631771836,4308695150272747518,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5904,i,17300430513489364320,1827335722784891593,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5896,i,3581914310672973771,5382849627096837447,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5648,i,10986416667450251671,11644350624454058750,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6328,i,12207860075108661096,12489796221961824272,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6500,i,16363139880932961701,2792060292894731667,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6052,i,1805042578213589102,11233379393976157076,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6436,i,7464494091168012929,16755446426395795414,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6716,i,11082828410903199160,4707510271700855872,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6736,i,9027271854418334458,15802041465849870065,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6536,i,15917303321584202801,10824827931335290499,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:9
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6496,i,4830298079860964413,15585402157274113535,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6608,i,12355419668733547758,7132748903526644606,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,13789055508792564241,3784755254164541859,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,9967816178761508196,14434711326801265550,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:14
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,612932803283748019,7112894762791163292,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:14
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,120722752150825500,6003852330675488403,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,12851832346283750926,2324144807784017494,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:12
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6680,i,1814761449335482478,3339777345008621559,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3460,i,4896815579548823541,5113380778876665469,262144 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=1600,i,12092677410380377082,15842735591875550419,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6372,i,16425232912654161214,6527712725129502701,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=3372,i,4981369902815426238,16154788490458057643,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5764,i,8900139679915758654,4268370345084993833,2097152 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,6000263749580617954,12377703208625155064,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7264,i,13991197226775467850,3068884159926516356,524288 --field-trial-handle=1936,i,10092014384306597046,16570152038214855170,262144 --variations-seed-version --mojo-platform-channel-handle=1604 /prefetch:14
  2⤵
  PID:4708
- C:\Users\Admin\Downloads\rans0m.exe
  "C:\Users\Admin\Downloads\rans0m.exe"
  2⤵
  - Executes dropped EXE
  PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffdbe6cc188,0x7ffdbe6cc194,0x7ffdbe6cc1a0
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,12960230494710890179,10252403769184625100,262144 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,3110415543052984146,495435760876722018,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
      4⤵
      Downloads MZ/PE file
      System Time Discovery
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,8655672220569741103,16512621783684362493,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,13152471779422446675,1660521552494534944,2097152 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,6436990171755172680,15574353316630349278,2097152 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,7771506457064693550,9130547433266270046,2097152 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,10778110246757648600,16467869774585636809,2097152 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:9
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,10186870993299799685,11570722263874261454,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,16993706241815946913,3816323813280832278,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:3636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,9786991281287888844,9171281479284700855,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,11201150074198994708,18048171785662939810,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,11201150074198994708,18048171785662939810,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,17970950925049307370,944075416854656634,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6224,i,14434000702659255096,18395761284067047312,2097152 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,17976626484076883334,6511635018357780884,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,6840487254470659320,10287815779663537559,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6940,i,7590041468861544457,10222215547361180138,2097152 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:1
      4⤵
      PID:6588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,261933898026669953,12784973703672269796,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6272,i,10096741113807254116,12351696434802716926,2097152 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
      4⤵
      PID:7060
  - - C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe
      "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.12-win-x64.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\Windows\TEMP\{937EF873-846E-44CB-9C81-930AD4094975}\.ba\wixstdba.exe
        
        "C:\Windows\TEMP\{937EF873-846E-44CB-9C81-930AD4094975}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9AE2FD42-1589-42A4-8409-DB0E80A1F82A} {6F26388C-532F-425B-994F-792EEABDCCAE}
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2744
    - - C:\Windows\TEMP\{937EF873-846E-44CB-9C81-930AD4094975}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
        
        "C:\Windows\TEMP\{937EF873-846E-44CB-9C81-930AD4094975}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{ED4EFA54-8C83-4983-A2B0-4DB10EEA7D92} {BB8E714B-6F02-42B5-A79D-942C3A85AEE5} 4856
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,7606327479936439312,12606310121387299754,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,8466156349056678916,12653363585104517796,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,17258313975520726661,14428446706475841629,524288 --field-trial-handle=2480,i,10651287928789691456,3207277244101209825,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:14
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:6672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffdbe6cc188,0x7ffdbe6cc194,0x7ffdbe6cc1a0
        5⤵
        
        PID:4656
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,9071510063467113018,3055081464479232253,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,12045109383851860718,11551786062335640054,262144 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
        5⤵
        
        PID:5584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,12679928527732105096,1004648776553019139,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:13
        5⤵
        
        PID:4876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,3617236621091531379,15468493068074426354,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
        5⤵
        
        PID:3752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,3617236621091531379,15468493068074426354,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:14
        5⤵
        
        PID:6296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,1488864737881119535,6894101959894121604,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
        5⤵
        
        PID:4560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,16953369980861970730,5863338070710616440,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
        5⤵
        
        PID:6080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,662764641513676455,4117111767483825915,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
        5⤵
        
        PID:4644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,6448976713548509443,12849466600400372501,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
        5⤵
        
        PID:3752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3348,i,13087604102037959628,5724829772693181551,262144 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,6112363562882212899,2597989100713448091,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
        5⤵
        
        PID:6688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,238975710731371209,9165497114837131352,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
        5⤵
        
        PID:5236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4124,i,15446921412206165119,13121023480061437564,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
        5⤵
        
        PID:2872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,9910395522928228658,12681680717701856457,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
        5⤵
        
        PID:6712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,12838271885038740546,1934360386474152367,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
        5⤵
        
        PID:5160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,12419137913264199860,1443623095838027352,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
        5⤵
        
        PID:2628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,14821477644484284336,3017209134602243477,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
        5⤵
        
        PID:1496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14667115614849785448,6112480375636331267,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
        5⤵
        
        PID:6480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,16556981175303303894,334775621410414198,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
        5⤵
        
        PID:6388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,5083448220984066152,8449827579908220237,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
        5⤵
        
        PID:4564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,2911920208112378566,7324821825492624896,524288 --field-trial-handle=2208,i,16560894591386888898,14488695113979451187,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
        5⤵
        
        PID:5480
- C:\Users\Admin\Downloads\rans0m.exe
  "C:\Users\Admin\Downloads\rans0m.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Sets desktop wallpaper using registry
  - Modifies registry class
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F8
1⤵
PID:5040

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:6632

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3996
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 50572A5ED009D5EF2BE48F9B44E6569C
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:7112
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding F165F24A366B173A7EDA46771EB77BAF
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6160
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 6736C221FB3596700789E253F33CAAE2
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1048
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 30840656019394CDA2453E7F75BD5FB8
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:7140
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 09A62EBAB13F9BEB74198CD00987B676
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:3888
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B507F0E60820E1ECD56AE10E0C0FAFC4
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:7140

C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
"C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6988
- C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
  "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.12_(x64)_20260925172740.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2796
- - C:\Windows\TEMP\{99AFBC5E-DE65-49D5-97FD-F8F1981D89F2}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{99AFBC5E-DE65-49D5-97FD-F8F1981D89F2}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{3FE3E3AE-545A-4FD3-B3DC-AE17E6A4C9EB} {6790BEDC-2F9E-4F27-B826-400A87AD2896}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5384
- - C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe
    "C:\ProgramData\Package Cache\{F81499EB-06B3-470A-A4DB-D4B58AE6AEC2}\windowsdesktop-runtime-10.0.12-win-x64.exe" -q -burn.elevated BurnPipe.{6F8C8308-7F61-43B0-9E86-61BEE9266180} {4659553F-D8BA-4C3C-A0A6-6B64B47724B3} 2796
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4876

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6748

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

e605ae9.rbs

Path C:\Config.Msi\e605ae9.rbs
Size 11KB
SHA256 42819f325ace7477c0e9d7835285873441cd79275d26e06f5618fe50d805eabd
MD5 25aee2c544855c4837720fd130031eac
SHA1 39b2948b613b19a55720d08f230d7cd22e2c44cf
SHA512 8909e437957502fd2db85bc6492fba1737474f61afa1ebd45ae14c7c900a989d96d85ddad9c1d026d033980d2270b1aff86f9829ae60e0155dfe712be3f16002
SSDEEP 192:NKv1TCNya9tl5HdSO9Ck53KnIl3Kn7lEy8FCPePp/K:Nc1TCNya9tl5HgE3Ku3KVW8
TLSH
T187325296660182D3E9962B74C70F1B357B73D2DA9348A79F09CDC1245F273CE0F6819A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e605af0.rbs

Path C:\Config.Msi\e605af0.rbs
Size 9KB
SHA256 3d7bd08b541c6e6982215e2ee9a3203bf9fc70d43b94564b5b158c7dc6cd9ae3
MD5 7e6eb433d2631bb0abb6b4cc60de721d
SHA1 3bcd65e7c2fdcaa3e90bdbc887e219bca1167737
SHA512 8de262b9d25cee7e0a0f8bd0fcdc0ebdf040946753eb7b036e68c63ceee193f351bf8c06e47c71c8d94cdd44440644c4fce3d3a6d62d6cccfb096bd395acdd4c
SSDEEP 96:Ym0B0y/ALrE0MCH3VGUlUeD2KPKACsTlHUlUeD2KPKAC6jfsQnUTl+nMLE5t7J/d:NYJ+KCl5ZKnI6ZKnjZEHRvaePpx
TLSH
T1BE12200166048BD3F9A26B38DB172B343F76E3DAD214179B049D93344F0B7892F6A19B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e605af5.rbs

Path C:\Config.Msi\e605af5.rbs
Size 49KB
SHA256 bc1b3b53e65b7e7d2610bc97e13326a0160c33642999ef920c1dc21b42919451
MD5 72848f8cf80da7d44ea1f257b4a888bb
SHA1 0452fa77b797ac3d8346d72cb14e70580f19fcbe
SHA512 37ba8003c2f6045def6f9206e64cdbdffa2d10180d1f5c32dbb4f8435001d3dd3ca6fcafad34e54af1e594d30e9da79dceaf496963a4b7d2c8964af3545198b5
SSDEEP 1536:L4OMFA4VnTxhBGGNpC14R9poCUv/X9u7DwzqWQn6XnbrFZeEB3tve9wN1E6sLYe4:36/e
TLSH
T1CC331E38FB80C1E6F633B9A9B330D9447349CB8597198D9917CE0509CE8679D6FA83D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e605afa.rbs

Path C:\Config.Msi\e605afa.rbs
Size 71KB
SHA256 e15bbfc7fa1498431f282429b8bd746c519a4059c7129f503d85e08056985b5f
MD5 44b1797321931893a79d423bc9885d02
SHA1 f00405ca29e35f7e8c73a9c6c97b2747984ef01d
SHA512 0e568c3ebe26e7dc62e8592f32ad6d64d42d773c47cac6bccf28bbe5641b5bae129921540dd7a86528ff91a69b3ca4f51589505dc62fd57d4eccbbf62a551cde
SSDEEP 1536:w+0pVuVCQUF3YJvOOfcVvQHNxaeeskGWcgayskAKwVxNbTO8E2fu/ocV4qBgpdWu:th0Z7Aj6s4Se9eIOm0i65
TLSH
T12963DEEB5610C5C1E8322A5813FBFE48AAD9CD67B344463D00C5332ADEB79C6DF68991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e605afe.rbs

Path C:\Config.Msi\e605afe.rbs
Size 3KB
SHA256 2d770c456daccfcc60bf0325b4de21d41ac8441a19da2894db82b27c42b2958a
MD5 edc1131401174282e07b9bce2965d041
SHA1 241caf0d0a6af15430ca168c130d93631a22e9b2
SHA512 ff8b6cd2bbcb69f45ba0a680a071b39943819e55c43ad1727776dcf8915a7011c2d208476c3913343c13fafcdebc31a0554d4265faadec5d3cce1dc710e0fdc1
TLSH
T1B471CE02DA40C6D3DCA22B35CE271B6133BBD3DA9324838705DCA5340E4778AAFE9246
MD5 SHA1 SHA512 TLSH

Submit Download

e605b01.rbs

Path C:\Config.Msi\e605b01.rbs
Size 3KB
SHA256 bff5e2737c91050dd50a9a0ffd77f627850384f421382fc649709b3c7979bd6f
MD5 53279a0304994f62058ea7cba71333ea
SHA1 3d907cdb63c80fd952fbb88d342780b41e3f07be
SHA512 1ce19444dc1df07baa6bbdb76e510001fa8e3c27e6c922a38cc2887a2372d3b83c24d90f0eacd28517a16f886bcbc4c5a654ec88db107174f556c29495786945
TLSH
T13281BF43AA40D6C3ECA32B34C9171B1173B7C6D7A364434B00CC92714D57BC59FEA686
MD5 SHA1 SHA512 TLSH

Submit Download

ThirdPartyNotices.txt

Path C:\Program Files\dotnet\ThirdPartyNotices.txt
Size 77KB
SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
MD5 0d8867a25ba926e6e40cd52ab3536b5c
SHA1 89390dc8b8318d0bfef1c6a2fb4783537e28a465
SHA512 317ca335405274f4f91b173651ca2826760acb5ba5cf41aff51adc55c2cda9059fb268333665f13f62fa48119e55a303720a780dd58d28dd9967db4c88407d61
SSDEEP 1536:HA9jHwsGfgg39/zwgAVkguQxrDjugtSEGepkWvrpX7anuqdLSVnfiStPq+3LefrL:HA97w/ogz1AVxuMjHtSFULryLOgrGWm+
TLSH
T17773A45F7E45077319E2C3916569A8C5F22FA02E3B6B2A44346EF248133B42DD6FF858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 163KB
SHA256 21a46f1e5235cf4e844b9de5429f0e198b9c97a41f0503a66442f1d639ca3ee6
MD5 522dca4be4f99d21ad35ebc3bb24a066
SHA1 5fa4dba916a6bc846eb6001e7f6a468d04c2be04
SHA512 3d65cd300176d21c95c2ff5a75cea9b478c505dd42bf95d45a0b2486d544096791eafb04aaf3d42bfc4e731ec4320b47cd2ae3b57c5a760f6a89645ce11ef98b
SSDEEP 3072:nGgPR9lIuvTSBbQ/09n4SbDqIG/Tk7l55wKjpFF:nGalIubgbQoDvqIrthr
TLSH
T19FF3071AD65811AAD16E9575CB528941BB337C668BE0E3CB13C0F8BE0F726905EF9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000031

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Size 383KB
SHA256 b503eb12a72bfb83f98467474024a8208767258225d21c63db12c49d35ecf0ac
MD5 b84e0ef67e175e84286e01dde3a563df
SHA1 e2d27d8e0cf57497bdffefae30ed26d00f379d79
SHA512 23889fa0db1e86b56b82284508a50d8911b9a36a0aa3cdf2f8fc777f7d35afd066311e97e4fad73b93404e72028096bdf70a793245713de27dc468c97a63c591
SSDEEP 6144:/UqsNKNl1xqIqk/h7kYoQzG8F1DFL8LvyJa3zSWzPtqaNsSNM2UrNAfeil8BfnWK:sqTXj9k1URLCyJWVzlqaN5MLW2rBfnpX
TLSH
T19C84239F3F70DACB307EB41F3758996C748379093B90039F9C98EB2904AE969B452875
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000034
Size 59KB
SHA256 40d2af64df9a7491fea565e0813e5b528669920653278940c75d8d7e84dc560f
MD5 5fb6303787c52f4483f55ad94db01f1f
SHA1 d87ac4f08cc59b32f7392a31c1831d1f01afd873
SHA512 639419a82f2c447e72e346362072d1844b2d1d753637a853c5b77b51d09b0c56a20d97e78dd5c5ae7392016c3fb11844329653f4425b42122edf847c76dc741d
SSDEEP 1536:Lup63Wyzdq6+Kzfeq4dqN8iDplmJMFZIF:LupEozKzfe3dYXGMFZ0
TLSH
T1AA4301FBB3D070986AD19B963370CA619D44D32D3DB35A4A51D1D08E8809BD4BDBB207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 116KB
SHA256 2898acde558a87589271aba4dbcb29399d613f4bd7447e6970f9bcfff42d49b3
MD5 348762f3116eae05b29e5793d9d5e959
SHA1 e83876e69dc9d9469b41918aaa8d7de50917d43b
SHA512 e20840963d09ba3f89fee5d7a892135860ce97f564f4872ce8ebfab4f7b9eebca5eba6d073c0c556a86a56a0bec79f18f1444fea796da3756ab9e572771d50ea
SSDEEP 1536:XgBki9fcuB/VipHmRCGuEV5NJI3A1MZgGKIfMgPNv/lalB5/z0PtaO6e+leB9i3t:XgBkKfWGR9JjGKDglvS5/4PtaOoeD/oN
TLSH
T19BC312F66D3756AE173FE6C8075C0271FCE6454708967E9BCEC4FAA6F02196D222CA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
Size 62KB
SHA256 58cfcd31da1e1483736ef09629900a91e88abd5553e9ae11ef022a1f4beb00ee
MD5 bdbbd2783a94cc1acc7e3e705b02e4e9
SHA1 674282e99ebb5d516b5748e4c31943189613ea7c
SHA512 548bc9bf2612002ae56f970357f585b3959a48e89e86d6c5416960b0e400aef93dc4614c60e07f308b7b9026e85db82350b80d224d50fab71743ae081a844d4a
SSDEEP 1536:kOajOTykf2efLzBm4lCwsqxhgdfJo5ZLFBnyPNMRa3Hy9jb:k1gXhLzBmuyqxhgxJorbyeRa3y9X
TLSH
T1FD5302A9B6626EABA0259D25E5F78E085947D04C03379CDBD3C18AD5E0C4B7D2FE3031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 09fee3bc1a7654da6fe0cc239e54de88531350a417cf6541b90bda5165f980d8
MD5 c7de337a8da2ae53f47470a8b988f586
SHA1 4cbb3e754cdf00ef7c25915a15b644f07d445baa
SHA512 feceae2607aa969bc272c5046c7553cf1546af88058e62f12f83f9101caa8e3c754a77d2e3b11feef220fcaa19862299887c4883d7550fd310a14cd5dd9e33cc
TLSH
T140510209C25F8997CB9B767C90970C2E196EE4BC9FC1375FB152E8D837861B60A40F24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 bf791524b288a202c1d76b52ef8e3e3e3cc56e05095fdf81e079a07a4847d9a1
MD5 6811800b1f7a3257abf58ca2fed7a18b
SHA1 7ea90e0aac4734a4523e14713e1ebd7b7e21f6fd
SHA512 6b1872a84098260ad4f9a3665e30c37510a4d82ece2f33ded6c177b9da0ccf052f74e00fb8a29bbe99ff4bec7392346c2a3c719a1cd7b52f5560b39d85dbc5cb
TLSH
T17741C00CC71F4A91DBAA3ABD40E7081C095BE5BC6FC2766FF19669C8335A1B70650E58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6c50c62d275192361563489b1ed23ceb884d65854bdc209e21390d028540ee64
MD5 8e07eb38b46c72480c7276653b8e790d
SHA1 9edabf4db84d1f03e3878301c6c0c152c2a37181
SHA512 2ef1d55db1af4b43e777335e63c028112ea22f30d58fd936e0b679acc35f95e579ad65b6f5c4e973469e72f5e15754c681761e75232c8715c76c7e880e0450c1
TLSH
T14131A70CD74F4E85DBA939F840EA092C0827E1AC8FC1766FA143AAC823992B71640E48
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8254b87a4be81302031e6d9c2f17272046685e60eed937fa5c89b4879d3352c7
MD5 0e42ddcb944ac5480fbb3730b8a3ce8e
SHA1 ab7d77644234e2fa6c2234ad2fe9dcf73d5c9d7c
SHA512 21da10c9c3c10ba8b16a37d315b079f2fbede4448a9c14b6b504878ea75252ca6690fc177820c7898e81f355553576bd25a56b9ce2aca270788096e37e914cc1
SSDEEP 96:O3TQfbhRMSH/+fMbz2wvzbxdpsK+e77OSfck3iTBLUowR7KsJeMxd/Ggcb8Yjy6N:bjjx/gIZvausyPM
TLSH
T1CF91A80D964E5956FB7A357CF0D70819347AE4EC5FC32F5A6043A8F42746FA70A40AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 225KB
SHA256 54f7688cb149a0b1f732fe70697b46a39ab7bd78ff73296e3baf7c9fb0b00347
MD5 a2eabb103c2305dd1f1c62df01fee62a
SHA1 be0b6967c5088b4d037bb34a8e6a49ab6b58f78e
SHA512 c3d244174d8268650262f5709bdb6efbffd1d792fd6050aaf47c24ac44b6eb9ce97b78dcad44a39031d3fdf9a116a1ab2ab664ae0c617cd3232ea903c433f8de
SSDEEP 3072:7j5GF1DslZSiiWRo5vZkIozoB6mHc5F5Z973PDXB3qMflhxEPDLt:qliE8cn69ZaaA
TLSH
T11C34F805B3D2B1D6E52E837619218C17E3BA4AC8564D70DAADA17A1C2BF7F803714B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 349B
SHA256 59833e3f8114908f50a496ed43d0e16a9441f0157f58fb482d1488797282b3ce
MD5 226bff0aeb27cccdf76a85cf9abf1a89
SHA1 4522db28b658c9946377b5971e8b5189b42c7d39
SHA512 6afc893cf16fcacd8050b4e37c07f6bdbee7464d5a84a8a4905dcf5fd409b55fc7274596bba3c79b8d80199a1bb02a702f817c9b5388ff030d190778856a2518
TLSH
T13DE0206C94CAC65F525480AB29347F0FDAD6570CD7CEADD54F07E40070C940CD1AD351
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

5945ccd5-d850-499c-bb05-f07aef4ab1d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5945ccd5-d850-499c-bb05-f07aef4ab1d0.tmp
Size 18KB
SHA256 de8661855c5ca7efb6f876e9acb7b7aa0354f4f48f6148c5bf8284194bd0d1a4
MD5 ed2b1742fcc8b2179ce7aa7724603572
SHA1 08a894a4940e3819ad66b3565ff7cfc27bb49831
SHA512 013443a419d21d0960d85aadabd568e9965ab6f38bdb96982a6c54d1bb12eac6c4169a682397cbdcfb5478117e42ee3ed618310ac93c31514af56d3f2c7cd2e4
SSDEEP 384:D5BhuhmWwGQA+LJJyJTMMEN3vpq+XpCZUh5Gzey6Xbv5+xKOeByqhWVmOK1PJwal:JAWPo8P7Rxa8oqI7ivSY
TLSH
T1E982ACF783E4C22DE91156F4DB18BE1EDE691A24832C3C76C9D5BE0A93E1032E25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 5969cc2f4a09abb3ab992efa17d9ccab5b723c7090f39d27c9cce008a4edb9ee
MD5 9f1cee345bf1264ba5ca501993f86c53
SHA1 1aa177b2f48ec97446a20b7fef6631c9b1838691
SHA512 c673a26b47d42ba1ae502205f3fa46e30a8e8ffe34ee02ad3938fa5345365bc2c5e68ac6f2de5f3f559cd6624cad1194f5aed26891db906939f3c7c4bab2fa8e
SSDEEP 384:D5BhuhmWwGQA+LJJyJTMMEDKsmqzaWFLQN7aXe+Gh7/6w/j7uRWHEDgmE1PJwaql:JAMGo8P7Rx9UVXqI8ixSi
TLSH
T148A2ADF3C3D4C62DD81156F4DB147D2ECE691A2883283C7AC9D9BE4AA3E2432D25574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 e4f9ad31a0922092847e54288c16ad9d60ff3ed2ce743ce39ce533813a276482
MD5 afdaca951ddc32caf21210bd77b2a66d
SHA1 00ece48a81270a37ee467e5f1dace5a2fa934199
SHA512 b28482bcce5cc52f3a14f2708c198e07c90075515d33a0adfd77b1fbfffdcd2e963cb8024c152e1d4ce562aadebcd18fb0d17e05a5c4dc350de493ede9c83db5
SSDEEP 384:Dm/7BRPne3r68cRJAJ9GR9DKsmqzal1PITK4waplGIoI8I1WdnufIENm4AfJbwCp:UScBbHoU4REjat
TLSH
T13962AFF3C3D8C62DD81156F4DB257E2ECE291A2883283D26C8DDBE5B93E1472D25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 42afe1f9126122a19036460c825043781a6de55660768812a4fc6dc3608f95d2
MD5 a92158abda1484128d46fe73ba116f34
SHA1 8db8dd7b03546998cf1c845a168b570c2c6e9f90
SHA512 5e0f948d731ca82926f73c273a0d6d0a9e4bf5ae52a0bd61fef3c1541c34d7048892b4f6fbc50758221d066871d12accc0014e33ea48a792dbe70e8cc6fc33da
SSDEEP 192:Dm/7BRPne3r68QJwAJAJ911PITK4nIIaPhFUDJ2vrfP7NPZIEdIiXpDIy:Dm/7BRPne3r68cRJAJ911PITK4nIIapJ
TLSH
T1F412AFF7C3D8C62DC84156F49B25AF2ECE2A1A18421C3C66C8DDAF5B93E2472D25534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 55e030cec6eb9179137d94c871f94ee333905975cc2bfffffdc880ed32183561
MD5 8869a9ada8775497d10d671d18bba416
SHA1 cf2df3faccdffb6304acb0e24e395ade12a06e61
SHA512 e90cbd096d7c8385166ce4ea8cad6c9fb8dc02a7b3b626340ad54ec1ccd1ce032cab85e07247f437baf13bc537fed2ec7a59b8bb902b05899e33f317e831bdc8
TLSH
T174419C97D67E7877207F4DB70D49B85959BABC32095274F4DB6BC22C70919F70A13022
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6e9b35c6457c8694fdd5eb20f44d632944aa890839c5044303689200988601de
MD5 22a3cff2cbc40c04abd2a4b3fd0279eb
SHA1 2b7638996d276712409e568942259aefed305c65
SHA512 a3bbfd23339d61f8153fe91d4bbb4f58d5f4b9a0d53463580b44f554d44bb76876fe3641f2483f02c42a0ea41fae48119ae76c738265d0178d7b4535d6e85899
SSDEEP 192:ORWcBhOXchLv7H8vAPRp2YV69OHsb+WNntIo4Ei2j1eI26R6zVyIsnAUgvU:ORWmhOXkzb86Xekwla2z2IavU
TLSH
T1CB42B82DAD14793B6CDBD31AFA65BB57E7F9002660841E80EAFC893C14E79CC6257017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c8b26dfd3f8919dc814a087e22bfdb558a46645ce43c1a0f1aaa7679951e2ba1
MD5 1907b10bc6c85cdc5b3bd225bf78d3bb
SHA1 a5ebb85a7a7fb0e1ce4ff0b5fa756a6ce44936c3
SHA512 886f37f41caba3c1ec94f872d0aa545af9d1eca3b8563cba9ee2ceb56399b2eca9460c323a39eaf25f753c6627e0bfbb94f1461aed4caba8418c6ce9f394da19
SSDEEP 192:ORuOXch3v7H8vAPRp2YKz9OHsb+WNntIo4Ei2g1eI26R6nVyIsnAUge:ORuOXkfb86X6kwla262ISe
TLSH
T13142A62DAD24B93B5CCBD31AFA65BB57E7F9002520842E84EAFC893C14E79CC6257017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c476f274a2fb6ae878993c1031bf582e240157615c1c1d1bcfd7b9425e1ddd3a
MD5 a6e9aa391485aea6fc2255027c58d332
SHA1 391acab18a4e6ef2278795852f44b8358fcbb139
SHA512 85c843fa7e833e7c178dcf9db01668352568a12f080d27402d8275eb7ed66d61161fef70eb59e242a9b7c155db416d2ea9d6e75e9ef0da896781f68f8f2c9a03
SSDEEP 192:ORWcBhOXchAv7H8vpPRpRYV69OHsb+WNntIo4RGY71eI26R63VyIsnAUgvU:ORWmhOXkcb8ZXhkwlbYL2IAvU
TLSH
T12F42C82DAD24793B6CDBC31AF965BB57E7F9102260802E84EAFC893D14E79CC6257017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 04f25edfdb10f6ecacf047b99010f4c8d07236ec298be90f87ce3233740317b7
MD5 d5a4955bae76b567eaa2e8df7bb0aab0
SHA1 f45fb467c5f3684604ba44954e67dc4807eb5378
SHA512 27fc92ecab8c6302ee2cd32f5fa63269bc0576843ef6987c953137e0df5f33f7ac5beca8c1d969c72d491b5fda959df5f0b722e17399305f7a743bb10a912928
SSDEEP 192:ORWcBhOXc2OSv7F8vpPRpRPGhF4Q9OHsb+WNXEtIo48z+a1eI26R63VyIsnAUgvU:ORWmhOXe+B8ZXSkw2L+U2IAvU
TLSH
T19252B82EA924693B5CDBD31AF965BB57E7F9102560C02E84EAFC8A3D14E79CC6217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 21545d73cd6e7ae05ff940731c0ab3fb8936fb3d18e2d65f5d34c1e8c773ae3c
MD5 ef3a4dc4c3cdcdcea4d355e7fb47aa59
SHA1 706cd1035ed47bd736c6d01c89f8d3775797b206
SHA512 2c429a2d5cc6af0ae14f8d73e8e16b159face5e8d3446c9ba99dfd34f46e090cbd8722e98a5f3e718000f851d0edeef881ef14c8be9a99c4a016cbada7fe34d9
SSDEEP 192:1RWcBhOXc2lyv7F8vpPRpRPGhF4Q9OHsb+WNXEkiB8zM/u7w4K11eI26R63VyIs7:1RWmhOX1eB8ZXSkwWmi4C2IAvU
TLSH
T18A52CB2EA914753B9CDBC316F961BB57E7F9102560D01E84EAFC8A3D14E7ACC6117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1ba0d3b93aba8612e72b07fc2914e397d4086604afd534076c091d36ab2a447a
MD5 d989c88e3a5fe11f2236f18adec12f4f
SHA1 245d8b5e0f65c71f4214183514dd5e907b907ddc
SHA512 7dc0a1825a66a27e59d68b692a302452e3d44881b06f0ffdeb2b0be7a88c501152451b97b44eb93bb102fb1fe49fcb5dc6dcde5fe433a6c07110d3355f931024
SSDEEP 192:1RWcBh2Xc2l+v7F8vpPRpRdroGhmb4Q9OHsb+WNXEkiB8zM/u7w4K11eI26R63Vr:1RWmh2X16B8ZX8kwWmi4C2IAvf
TLSH
T19362DA2EA914797B9DDBC216F961FB5BE7F9102560D01E84EAFC8A3D14E7ACC6217003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 117ae587912beba624573dafbc4b723a8bef4ff0b58d158ea4ad3a97b8e56e6b
MD5 08b5e5398f482c8a441c07f70d8f92e9
SHA1 93a890f73927bbef1acb8255c7d185b6be9086ff
SHA512 5bb8a9e6bec324804604540c4d10d4142ed05a358a8e358f4bdbcbeaab55adb6ef29da94d48f5714f19b5e72d49c332889f87ca085a493f4b9005fc4cc67b1f6
SSDEEP 192:ORWcBhOXch3v7H8vAPRp2YV69OHsb+WNntIo4Ei2K1eI26R6nVyIsnAUg5U:ORWmhOXkfb86Xekwla2k2IS5U
TLSH
T15742B62DAD24793B5CCBD31AFA65BB57E7F9002660842E80EAFC493C14E79CC6257007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 122d6a67bc72988a85ee812cb96bc08b515fadfa7d33df01f22ce1291fd1534f
MD5 de0f39e848c4e53b6fe3a9d2a3eb64cb
SHA1 5937f41bc46f2f491ca700d5b6269cf3f0de6b68
SHA512 6c50543da2efec209ce25be823a4208be7b8c237943d87d4db3f3fcf60fca56eeade2d7bbe6cba7ced0d5a9394489c884442862ca6cc943f1e70a8a5ff27171f
SSDEEP 192:ORWcBhOXchAv7F8vpPRpRYTz9OHsb+WNntIo4RGY71eI26R63VyIsnAUgvU:ORWmhOXkcB8ZX2kwlbYL2IAvU
TLSH
T12342C82DAD24793B6CDBC31AFA61BB57E7F9102160802E84EAFC893C14E79CC6257017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1d2a0e0504e97a6d883a429b7e7082a19310bc0f58901783d8448e07bf5a208e
MD5 a8c3957bbfa839668f1a11591520c1e2
SHA1 5c3bdd8ed435194df37b41c6658bb7c7c85c8013
SHA512 acd80e5485101a085aacc721cf4e9de1390875449e692517e7d1fa634678992589904f824964654037421022848684f1bc0f8c7d4eb604a9de17efc36ee2f13c
SSDEEP 192:1RWcBhOXc2lSv7F8vpPRpRPGhF4Q9OHsb+WNXEkiB8zMj5Qm1eI26R63VyIsnAUD:1RWmhOX1+B8ZXSkwWmOQY2IAvU
TLSH
T1B552D92EAD24657BACDBC31AF961BB57E7F9102560C01E84EAFC8A3D14E79CC6217003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 edfcaddf7a9cb8dcdb75c3e2ee24050c06f5c975b314feab55791e8f2d604907
MD5 7f0c1b2df1a669c53e2fa9dafc936510
SHA1 1c4a338685a38e6a6be766c5c452abd14a90ade2
SHA512 9f55d76969acc77db4a53818d482c4aed8b24581c25437d0feb16c4209916466e65993521c55938fa56767eda640b605980710ab8be8cadf94c39afaa9753a9f
SSDEEP 192:1RvcBh2XK2l+v7F8vpPRpRdroGhmb4Q9OHsb+WNXEkiB8zM/u7w4K11eI26R63VN:1Rvmh2X36B8ZX8kwWmi4C2IAvh
TLSH
T1A462EB6EAD14797B9DDBC216F961BB5BE3F9102564C01E84EAFC8A3D14E79CC6217003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 32335b05004e301c23ad89f1c60e71f037c6ba794ae2db1b8e36868c0f0ebd29
MD5 87eefaa00ac3e4f3b5d0352ef47b995a
SHA1 a67325534e3a8da71fd9f4bb6e286c373815ca5e
SHA512 eefbb5e34e6947b2a227de03f5dc73aa2b9f7adc09218f2bf109947dc0364d36b52fb2d04ce45421515c8e64b0e13888f42336bc88593a630bf7601c52d7c7bb
SSDEEP 192:1RvcBh2Xc2l+v7F8vpPRpRdroGhmb4Q9OHsb+WNXEkiB8zM/u7w4K11eI26R63Vr:1Rvmh2X16B8ZX8kwWmi4C2IAvf
TLSH
T10262DA2EA914797B9DDBC216F961FB5BE7F9102560D01E84EAFC8A3D14E7ACC6217003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 de9fb1bc6be4c9abd2002753b6832fd11becaac728f300969c397e1875081d61
MD5 fbf8597b2d19c202e3ec8d7c0cc407dc
SHA1 4c432519d1f70abc459bc5109503392805e549a1
SHA512 babc183611ec8efb67b7f5f26bf25de5f7642f6d0b5d78b5c408b900b8f753ce1f0cbfec024661a6f56b2ebbcdc7b405badaf4ca1f78c4ecfabaea25d079ea6e
SSDEEP 384:QGjDC7KxkXqKf/pUZNCgVLH2HfgslDLXODgj+ErU32aHoPYD3VGjj:QmDC7KxkXqKf/pUZNCgVLH2Hfgs1TOEP
TLSH
T1A152F927948D9A3F0FD8D64CDC17AF8FACF502566668092453FA9C0903A9BCB114B2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2ee85419-8b64-4196-8f90-338af3ddd7f4\index-dir\the-real-index
Size 2KB
SHA256 6883494ef2074f1f5557fc7889f7c1ca0e6de37851f10e7d9b8f30fa37ac03b2
MD5 37022af53991630450582253e8f09e4b
SHA1 25701115c3eb6361ae40191836d9e2873a7d6162
SHA512 bc4d0df725890e7baecb01ad6e640942db0882059cff41dec1231e4fb14667901ccefc95a9753524fbc1c464fb99c1469818fa661e64278505a7de2bda05d603
TLSH
T1A951648CC880A7ADEC7261BE1D9414B253752C38FC59C7924198F1B134536691B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2ee85419-8b64-4196-8f90-338af3ddd7f4\index-dir\the-real-index
Size 2KB
SHA256 aa079e04ca304fffcff5302a6665b78d9395b44b80de5c32fc41f819fc71ddb2
MD5 88ff06d4e9722a308ce0f2649740c694
SHA1 2703f210cf43c8bd23536947837d5af191bba314
SHA512 fa62ebe5bcac3498e1b33d4d3b2849e6b74a305d7f700f2123461bd9f0de716093ee142b377055922deaf325e9d58e1120c580f82be5e27155ea64496a19c5e7
TLSH
T1BE51734CC880A7AEEC76A0BE1DD414B263352D38FC5DC3924198F2B534436A81B4BAFC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f49c4.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\2ee85419-8b64-4196-8f90-338af3ddd7f4\index-dir\the-real-index~RFe5f49c4.TMP
Size 48B
SHA256 5a53bd4eb496adca3997852ea78c750861634295f12aee1b6df49d981605094b
MD5 6baa902b710f9960644e9dd638b18a37
SHA1 2b83c379e62cab94601991e4bd17a356fc179f06
SHA512 b957d9a6f086a63231e66fced8603e427d8c472d76aedbaa5a541dab46074fc03ece5b49c74ab9fc1d9ddac424abab9f4cb6ddfa2f816c8128826e50ca773c40
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\9cf67fb3-4eb7-481f-bf45-568f6214162a\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 283B
SHA256 b48b1fab8a1b85642ab5c81094a4016116cdc4da1cf44da5b47407df23047d57
MD5 07df55a76b1ef099d445cd860d3b4e73
SHA1 e0193496c7303810d0ab2316791a4d77ebe52b46
SHA512 7f4d28b26e1892688f3049eace1cb4549875c6f9aa75cf27daa1e6d95dae2833bc423e667ae1fa022cbde54961d7b9c27003e4aca9969dce712e0eae222d3b5b
TLSH
T10DD0EB82A832800FCD339BB13072010FC1BA7C058804CCEC2D0C34061A7870B8005C27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 0b73969df8827611786cc87e49f4ef0a4564327738d93a8536d81c13e476634d
MD5 1c86c187e18c0f2070f3d5239d1ca990
SHA1 24d2b961e984de0b3a7e5f9de07337f50c284832
SHA512 7cc55b47f2eb9bd6340dc9a54526160952a372f8b6694ea95cff2cc3897e33dd6f2c711710efe4c52dc5327847c0210d8eda30d4aa2568e88d7729e115569906
TLSH
T1E6D0A7E626315B46167456B52028115D8126EC05D880C8E85D04B4966878606C51E565
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 1ba817811b5022d5e428e276b13a9146fba9ad03e55ac79c94a723077d253915
MD5 b5defbb01133b499710d438f0f521b51
SHA1 a103e5b3341876c7350bf319f142c77908656fee
SHA512 bbca17511dfb826c77150da6c19635be7bf671c10e362ee7032cc23f806346fc666173b1ef792b33fd6175d3ee372a4d40657247a4d57d44544a0dc29e37be32
TLSH
T16DC09BE71915964B0E349BFC3038571DD51FAD4CD8C0CCECA90454422934617850A975
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 276B
SHA256 57090fef98fbbf650b69381faedd7a3d74bfeb3b569df994d02ebe07223aafd5
MD5 af7dc33cf0494fbea7c9db99c04744dd
SHA1 3563a3f45dd0d0caee10bc2de2b17778dbd76fa9
SHA512 da994cb089d2a0a59cc54ce6a8e9fb8210620f465ff927968b5c872035d89f400bd2272f7dbe3c56b30857d2812adc289e75cea23680c34595514f890376490a
TLSH
T12AD02B92AC72945BCD73DFB53476511FC6B978168858CCE8590C150A1D69B075406D27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 276B
SHA256 1657f782e08d6efa0605f3fc5dd183bfb971d9d22620ceb88b1f81c3b7e3d034
MD5 ae0d20bf13fe863c3273982bf3f4e1d5
SHA1 9143804e1436c4d0cea8c7cf27f795ae98c15606
SHA512 74de95ba8b5e7e5d2416bbfeca7838da75f49d41e02ba45d85928cbb3a6c09ec629f054258f8e182bd69a70bf18e6b8a755ea5b5eece68bc5e3070b4a25437ed
TLSH
T1FDD02B92A822945FCD73DFB53476511FC6B979068854CCE8590D25092D6970B9006D27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5e8e44.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5e8e44.TMP
Size 137B
SHA256 130e3bff02854d6dcb77ed71a0c9b5ede2981ebf11144fabc0de930dd1ff2b90
MD5 f2c8adab1557c46556ded23e321dff77
SHA1 b952178b7f0085257bccb25f119247ee32be9eac
SHA512 a212e9f57d2acec50ea6246cbe7fb0daf9ace29ae7943789ae14db8ced5f402595099639890791814c7cf4a70ed11b4761e4b09595596f66283314cd9e42d6a1
TLSH
T1C5C09BE7191556470F3055F87038575DD52F9C4DD8C0CCFCAA0D74423934617C50D935
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e26895825ec6cec7a219f93c0d3b4dd2b4dad4a07e4f7074193fa8f60767bfcf
MD5 6e8794f6592c204b08eee7d3407003d7
SHA1 fd573ba9f5bf0e3daf2f1b52fa88e81c904b3001
SHA512 ee439769383e3c6b43a9dc64f8340514aa7feea12d82744cd3b449c7ff83ce63daff3204fda6faa76964f8d53ddbf0e04417f723fc6e5314ee14ca48e9af7be8
TLSH
T183B01244804A1501CC0085F01905104921105E359650434BEAD0E6E6DA872E02218600
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 fb741ec4ef140cb9be3613c029988e161f01b84043e51f3bf053e5467bf6ae4e
MD5 0cccb919718c001b5ce5d465eb6f6006
SHA1 4d23e19870a44ebdb48fb164fd38726c36446d96
SHA512 dbc92a5de973399a433eea0d31906013fbc3e0448eef2a88ee8bd978a7bd27d7ec693cb65da99073d72d75c549e7124cabaccab397fa8c3eb03b52806632bd14
TLSH
T11DB022EE00802003C80C83F2C3C23CC03B30BE3833C3C00280B80020C8232A3CF08220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 5657461ea2af33d4660507ba54b57ce5e7f2d3852f29a6a7755d5515c184882f
MD5 508501eac119b4c6218cb43a021cff86
SHA1 82702e6bbfab0f9a3ba452b42c5149d50d147791
SHA512 ea7e868afe624aad1878209d89b8dfbbbeb7fb952923bf8bc703ae3fde5ba4689eed31afced7e24425cdcc324ddf3c9c50f7cf0ff0eaa64927c5945848d938de
TLSH
T11DA002A045F51CF2DE51E67460B117E13361885D17DB574364D14D848D5B1C54201501
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d6dff.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5d6dff.TMP
Size 48B
SHA256 738dcc6b02e0438a6a4a8ba71e097e4e028d782c58bcdb1d5270c64866b42ad1
MD5 d2a26cee6e7e60cc377aa3744b8d828e
SHA1 975a9b1918058a4508bfa5343c47f7675b836f28
SHA512 60342a04fa58bd3d4a9d6d27a2a36f4d6aaf75ed0390b4d161405cdcc79d923f029890a27fc04d84627bc76f4c8de797d03bbeb2a69ccd686607afa7fc457bc0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4240_1639769860\Shortcuts Menu Icons\0\512.png
Size 4KB
SHA256 d345d2dbe2efd56ff9494cb31cae0e28cde5bdf176a22bca9aee27465b117c88
MD5 97193e4d969021cb6e6ad1b25bb7499a
SHA1 69cb3acd8bc0b31b63791efc9dc47d5657bbf40b
SHA512 1df06713846ea152089ea40434f3fcff250ba2d2c0b5afcbc546b82a65b68f3ad1cf503dbc4e8246765c01f191b4f8389c4c55efb7da507f443d858a8dfd704b
SSDEEP 96:TTcYKfambSQTNpzzBOWUjfRVS/TFm9BfyKhnaBS8ZP9jeLWfbOGp:SbSQTNh9gD+mLfB49ZILWfCW
TLSH
T1B0A1968E8CB5488E66658747D48538A2C5B030A7A7BFC3BE719D174851E32C6FF29B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4240_1639769860\Shortcuts Menu Icons\1\512.png
Size 7KB
SHA256 1e0b1b2e4dac49da1e2ce91a72e01f77fdb3bbb26ed3422e5d4037745cc307a4
MD5 cc525d60c0dc9696ddfe9524dc9abe82
SHA1 fc94cbd2a45bf2ff0fbe411f57a7cafa31126bfd
SHA512 09ab42f7dc3d6a08b9635ef229539a5c4c240506378a9de4eccf1f69d52b266222cdf084e9a567c6d21f19e61c4da7ccd98928870d6f10cd74e9158c64a4142e
SSDEEP 192:U3/tgbWgm8Xl2X+xqWwB3kUXPmv9rCywxAQU:2/rgXXExWKdXPa+txrU
TLSH
T159F1AF6F639B59EA3AF8493D4BD7A21FD62E108A2F275B71C5101045628A1C1FC69F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4240_1639769860\Shortcuts Menu Icons\2\512.png
Size 9KB
SHA256 ad08077126e7106674e4219f5f9cfac2305e8b3f627247c1d3e72136399e6fd2
MD5 660ae59d489be5b5e1e9036b88b4a033
SHA1 b1ebdb9421bf14b5c43a399b4dbd92288d91a604
SHA512 3bf52f4d1e92ececb7691bedf1f53dea75041615447eac2c1ec9f99d07417a571e08fbd2db58896506350e8af831e8fc943d35e35747a8cb6db9a03d880331f9
SSDEEP 192:uJTyU9sUZdxl59pfNK8EliT9Tjx/t0xM6LwZx4nwBmJH/Rr6O:g9sUxXM8iiJKMfcTJIO
TLSH
T1F022BE9744E4E7A3427CAEBF4684D914DF4E1B7384366E10020B199F0D7AA8268E8B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 c193a38bb1b2f901d060bea5858584a806a3da93e9ea922d36a9a7b90cda7c88
MD5 dc35367b0332b08af63e3b53f7243c9d
SHA1 d0271dad4c2667d5d1ac6ef73e951ff5ba884917
SHA512 3970513a70e2ea32096232a8fcd2cd161d5d1cb7f0fdba38247d1f608d2d21d54207f6918d7352de674cc7cfe82058eadd5aca8c3e8baf5024512514026e3e91
SSDEEP 3072:N6CEEV5iwT4eAag5CCmJ89A7tNABEco3gNVxlczaQ1RYIzpcYV1NCn8ZX:N6tEVjEfT5CCL9A7taB1o3wxluaQpp3d
TLSH
T1DBD313B1EC05FC6608B9486934063C270FE6E638898E74C9B991BDC6AEF79D14F27435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 6183cf2c8ec8c5d835c970498f23525314604ca99b8cda577e0527340ccefe11
MD5 ada60b3ad62b72f1532ffc4a2ef85684
SHA1 d7202a60fafee58430519b1e7c94925df9c98546
SHA512 ea97aa28f2cd61e78a56e09c3877f1805c944fd10831d7d1cf7094466a7363b8ffda021b9604f696d79b88739de874b7e19e9a2cb1e7facd6ed1af6a1a581db9
SSDEEP 3072:l6CEEV5iwT4eAag5CCmJ89A7tNABEco3gNVxlczaQ1RYIzpcYV1NCn8ZX:l6tEVjEfT5CCL9A7taB1o3wxluaQpp3d
TLSH
T139D313B1EC05FC6608B9486934063C270FE6E638898E74C9B991BDC6AEF79D14F27435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 680430ce7edafdc911db05b93d9feab8c77b00f6c052cf8d983f9c7762c7b19c
MD5 839415d52af5e8a1de14689c1b28e7b5
SHA1 704137ae88f956ede232737c7c6495e643b639a4
SHA512 2094be0d671ff742516c166a26d92980096a4f3347c67376a23a4e870cb78b4e973cffa9487fb949d5f668a5e5dc2467b96985441313007931e6b9c354edf20c
SSDEEP 3072:PnCEEV5iwT4eAag5CCmJ89A7tNABEco3gNVxlczaQ1RYIzpcYV1NCn8ZX:PntEVjEfT5CCL9A7taB1o3wxluaQpp3d
TLSH
T119D32391EC45FC6604B944A5390A2C274FA7D134448B70D69AE2AEC7AEF3ED14F27439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 2604347982153010f00c4da757a9095eca9e203fa064d7451b55e2203a6aec8e
MD5 d84889261fb6ddca9ee85648113bebf8
SHA1 45788e0c4ae225653af6ccb445933c76eeecace5
SHA512 5389dac3fa23e0955f926f7c9ec16a15a51e36077023f62e44955443821fe97fbb54491c436176f2c44657a83ffa660fe2bf4ca36796ea988762693aca343cc5
SSDEEP 3072:OnCEEV5iwT4eAag5CCmJ89A7tNABEco3gNVxlczaQ1RYIzpcYV1NCn8ZX:OntEVjEfT5CCL9A7taB1o3wxluaQpp3d
TLSH
T1BAD32391EC45FC6604BD44A5390A2C274FA7D138448B70D69AE2AEC7AEF3ED14F27439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 139KB
SHA256 3719e26b3eb07090e23d64de8b1318d201a7d3297d86b0eda113cf52d43a2bae
MD5 b064a735e97f342442d568cfb90b1a3d
SHA1 76e91da5c08d765bd035133bd42db9eb59a77f49
SHA512 cd91a0b062041bc7b98f8d52ecfbb1f2d31e9e806b8d1123c055cba901d9c8ac4cb0a1b3f251885aeccce9c3a52b526304907f63da25ad9a3f492b6c2cafd87e
SSDEEP 3072:A6CEEV5iwT4eAag5CCmJ89A7tNABEco3gNVxlczaQ1RYIzpcYV1NCn8ZX:A6tEVjEfT5CCL9A7taB1o3wxluaQpp3d
TLSH
T17ED313B1EC05FC6608B9486934063C270FE6E638898E74C9A9A17DC6ADF79D14F27439
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 ccf35fc76d43c3d67600cad8e2653329df2f097d120243369d12d1c2191094b7
MD5 d3cbf17c2e0d33a067b5a286b9f58cc6
SHA1 c361f247ba40112a9932c17b9db4fa9aaa5efe9f
SHA512 795bbe1583c9f54b9e68481ab06c1126477fa13cb923be196876297c206254a7b6349905b4677a4668e4dfff026d423cea30043c895567eb7bc3a0c6c5b52039
SSDEEP 96:E3C0d+OBIsu/Fl3fIUKsI8EnZIJRDotok5liD+B6m8dGyvELkaAMrbuj1v4a:kC0pB+fTbnvDUDm+4w/JAMrbu1
TLSH
T1A1A12C30B47888B755B5D5C5B5563E43CFB462A7A8109E80D9DD1F0D11A71F82381A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 138KB
SHA256 a72514fad9f620452d41d996e0b0b52931f87d30f4e3a827f4bb1aa1101bc62d
MD5 b659becc83c2de71318cdc8f8992aa7c
SHA1 4546c01a2c6356afe1ec03e58e5c45bfbcdbf76a
SHA512 8f16e379335f116ad9b432032b4f75aace85a3915c77526f80802dd67cec1d50f45474603efa1ae9c6fe388ae8009b1904015cb92e3e3e24c51d21f9b2fad224
SSDEEP 3072:66CEEV5iwT4eAag5CCmJ89A7tNABEco3gNVxlczaQ1RYIzpcYV1NCn8ZX:66tEVjEfT5CCL9A7taB1o3wxluaQpp3d
TLSH
T107D313B1EC05FC6608B9486934063C270FE6E638898E74C9B991BDC6AEF79D14F27435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f211ad3b8cceb115e85bb3587f900f7b57c763b18b837737bdd4523ed4de0950
MD5 3efd9e1a9e4bc75bb5e72db4e7f5f55c
SHA1 d7838374508e9cd780cb1d4ac8b36636c070c76c
SHA512 5897f4e962996fce838270b9d1dc0c1ce0594f3494289c4a6e91f06a11ccc6e677d3ab64762b44ace2db6b46961ffddb2c64a44bcc5109e7709ee6e7dbe0043a
TLSH
T1D0D0125999699AE5E43218B981E14208329966929D02110A64405D150A7538204918E6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3293dfeaebee7ed6f9cf156bc72ed7d72556a76a3a56ab870184e7707d09e9ed
MD5 9f25a30718e62410fe840703c0c20dba
SHA1 728c58e8dab89f09c17641327c1fd0544e5cf0d7
SHA512 c7c91e48a3b4e17aea645f8403bfe360bf32e54e20ea546403cfb4c4c25c36d5ea90e2eb38bea2d009962e00a1c7d1ad241832ad38f2116e952a89a308b7b1f5
TLSH
T1D5D080DCF5694E64E8231CFD54D1530472C9F7D4FC037045F4815D29177679111900F1
MD5 SHA1 SHA512 TLSH

Submit Download

5d4c9471-f9ba-4389-99d3-08d23836f0ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d4c9471-f9ba-4389-99d3-08d23836f0ac.tmp
Size 414B
SHA256 326decb03c4fe71357ace00a55293726bc06e87dc7ea86d8fabb6d246f287943
MD5 63954163eef8a63f07123e48a3f33e2a
SHA1 d77da54be36956354631325c201cf503803803f9
SHA512 993d225f9f726c5b531583d4e4c3c27627218fa25b456506c493ca9eb3ef15d50dfa7413b72c59ee7a4a90bce3d82194798f46ccb94ffbda0780361683d2b506
TLSH
T1C7E02BD9C920AC3B49FD572F55254746E76513563680494F3E3C820D4FB27364196C6C
MD5 SHA1 SHA512 TLSH

Submit Download

7f64ac4b-64d3-4992-ac7f-02d0552b569b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7f64ac4b-64d3-4992-ac7f-02d0552b569b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c6682beb41243023b296f73f72217cec0698853ba5562cc1e0a98d75409cdc11
MD5 cb945f70c150affab27dce910a174b9b
SHA1 c754d306c98f8deb4f1139dc6a7de070042c06ae
SHA512 b17a9b36e6b9754970b2d7e21caac785bcebf380cace8290de2ada3d55e858102a6deddab4b818e6b37603cbf6540b74f0aa6b5c315bceb6adfaa987b52555d6
TLSH
T1D731660BC3AC10C4F7B4647C86D5071B3AB4F58C5B5B1E418798C1F9AE8ABAC72909AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe606815.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe606815.TMP
Size 1KB
SHA256 1eecb6e8971fa93758107bf5daaab5a762dcc61ace13a56548d30880de39c302
MD5 e2a44f8ccec0b7a8e09c948491339161
SHA1 43f967c4f4aab31605a66f356f879b97e6a30802
SHA512 2f0e0bc632b00bb1cf785860c56c12b0a60cc3d641c2a973ee7599c120b23a61398d4a74525aafe2e5f558fd5c3311f1c68d909fee7befbf542b9f5ec6d6ab29
TLSH
T1D231224AC75414D8F3B4457C8AC6170B3AB8F98996931E4187D8C2F96DCEF7972808EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a73efc683a5dd4f489080d425538087117ae9fc75c0fc109abde307228b415c4
MD5 5aba1b1bfcdcb1e8b7749d96700cef0c
SHA1 e5a6590a4d86ca616f35fdb0e6bcf033cd7dc869
SHA512 7de76106a6d5b0911e4d88fecfe6803abcb09679e5ed49ef00bbbbb162efb10f7ae52c7af0d3fa80f063440f1d83dd3b292155f318e8187938f8d5d1a6d1f9f7
TLSH
T1C771BEF787F4856E8A0195F0AA18AE2FDF2D0525431C7C6989E4AE27D3E34B2E04165F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 53a80042278553e96e389535697b39f4f8653153324a2e2ef24498387664f217
MD5 bd3d3ec8bd414f725668f9ea1846dce6
SHA1 5adbe0b16df5134f17eb3ffd7002ca5f69351836
SHA512 4e80d80250e9036e3106170af8afb7596d7376164908c0d4badec762f48182ae62582a3815dfc285728c5d0e8d0613eb001eb040241575c5c4b75530eeb47575
SSDEEP 192:sxRP+On/fMs2WpVz2ZlkpLzoA8p99/g6+WNt0NBuZA4fY8GgphIgDT9J:sxRP5n/fMs2WvzAlkoz/5K2ZdNn
TLSH
T14052B95AA928A97B9CCBD21DFB557F23D7FD103261D05E48AAFC9A1C00E76DD520380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6561291b13ea177aaaf869712f0c8ce728cb9703db8a34ae572a43b9469ff9cd
MD5 321165c7782b442468511af595ad6b13
SHA1 6e3ca5a1ec4e323e7069552862c03c163fcdfc10
SHA512 5a7051cd1ac96188404b6465e666aa2af221a4d28771df51aaf994ff038ba36d49264d5435163b94ec7aaa1dd5b340d315febf48b6125fe7489752a96a2f2d48
SSDEEP 192:sxRPmOn/fMsf2ZlktLzoA8p99/g6+WNZNSXA4EDaGphIgDT9J:sxRPhn/fMsfAlksz/5mXkNn
TLSH
T10042B859AD28A93B9CCBD21DFA557F63D3FD5032A0901E48AAFC9A1C04E76DD520740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a32e893002fc53718a26903dca81f364be6b246af29b4ee7acb09cf56ec407c2
MD5 4c4efe227694ffb8dcc3dedf1df13f9a
SHA1 4c950c1db0759e3ec154911227d1c372624a1581
SHA512 40f9166f4b697a7b51beb4bcbd6b469d8b476a94dc9123fbe57eda4de54e6eb4c31e732f82c076d928869b1bdc676c6100f4ca9733a91dc126de618a68c60011
SSDEEP 192:sxRPmOn/fMs22ZlktLzoA8p99/g6+WNZNSXA4EAaGphIgD59J:sxRPhn/fMs2Alksz/5mXRNJ
TLSH
T1BC42A759AD28A93B8CCBD21DFA657F63D7FD5032A0901E48AAFC9A1C04E76DD520740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 473e54fc005739ea56a9dc059a1e861ebf336c7e403860c128763955e7f41e3f
MD5 99b9c70db32eed2a5b2fc0328cb87ba0
SHA1 b9c0e9ef7391a1ddf6067cdef4c8c1ca1e927230
SHA512 07976f28a1a16025fb150e7b4632bc3cf39d43a67bf67867610322c21ecc15808364fb34eee01767b87fe550e96b0a6f32e1d2e358db4ec307fccaf30c634b51
SSDEEP 192:sxRP+On/fMsxKWpV92ZlktaRwZLzoA8p99/g6+WNt0NBuZA4fY8NGphIgDT9J:sxRP5n/fMsxKWv9Alktqw4z/5K2ZiNn
TLSH
T12F52C919A928A97B9CDBD21DFB557F23D3FD103260D15E08AAFC9A1C00EB6DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3d64d4a2152565ac400830e16aad2189ac0038047e23e2417d9641543449ce4a
MD5 a59e8e7109b7e6898967aafe79718df2
SHA1 3f0f9cb770851f302fd7c84c7104dcaa9fe22dd9
SHA512 a50ed3b32a625a2196239da4e1eb20668604bd104e70af3d6d8d78fed0be960fcca9f253ab328e5661ab18ea028dfb36ffa56fba5d8d4bb474903d23f971d92f
SSDEEP 192:sxRP+On/fMsf2ZlkpLzoA8p99/g6+WNt0NBuZA4fYLGgphIgDT9J:sxRP5n/fMsfAlkoz/5K2ZINn
TLSH
T11F42B85AA928A97B8CCBD21DFB557F63D3FD503260D05E48AAFC9A1C04E76DD520380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff13b97d126425b0ae5ecd015b00910ac9abc2bc12847f2157a57a2032293acc
MD5 0f9433e4c37545e89e557ea69f730dc7
SHA1 412858033da77f6b672ad38e4a1c001e3919849b
SHA512 929f9e5ed641e93d4ac94dd9f7a1bbde99db395d59aa62448e6c9934912f920c16a67eedfaad47947b263aeee2c86dddeaf62258617196f42600dab7460c29eb
SSDEEP 192:sxRgmOn/fMsj2ZlktLzoA8p99/g6+WNZ8l/A4E9aGphIgV9J:sxRghn/fMsjAlksz/5O/SNR
TLSH
T17F42A715AD28A93B8CCBD21DFA657F63D7FD5032A0905E48AAFC9A1C04E76DD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ba8188208bffe02f776454270776a97167ba5761b6ac05d6fadb7c663699de2e
MD5 ebaa86fa7b4db4d9a0c79ecc1c3d52aa
SHA1 c43ea1a7edd178b3cfe099148261533fc32bcdf2
SHA512 1df06150f3c4824a9616e004d4661d112604c3fb80669210b1eaf3fe95de183d135ffff3bd7c0211f0e3ea9436a52881027c1ab91cec944249a59ac0409c4474
SSDEEP 768:U/pCGx7pLKLFLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVt1uyhpdroJI:U/pCGnQFLmWg8KfrLu1jaW1u8pWG
TLSH
T1DED2DA7B780CCB7F4F804ADDA8197ADB6DA802CB9698CD4047FE941D02C77EA91164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8e78f2a0c6f2fb37ddf3477d4ef152597dffc7362e4e3254781e2b41dc42c44b
MD5 ae79f9a82dc9bfba66d908f93f99da12
SHA1 44d8efb98a374e2b73556881d918cc10d46e4641
SHA512 2340f25bd5ae58807ef17984c987e408c503d6cd1d73d34b45f973c3210c5c602de3b19ced4061ac1933389042b8e79b9aee24f47d07718d45f18360359ded07
SSDEEP 24:K9DIn4rInKvhG1KSO5LyXxi1a4gIJKehY1CSfgfyX7M/M0+IpKshM1iSBiY3uOJh:Kc4InKJGcnylDIJKIYsVylBIpK6Mcm
TLSH
T1B291F04130BF02013E7E254894A5871F078231A671ACFF7BBBAD149A4E27E281DFE5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9af57526-2750-4278-8e52-5d394e1afae5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9af57526-2750-4278-8e52-5d394e1afae5.tmp
Size 22KB
SHA256 41d7425579d647887df4b3dcad99792016f6693f9de05ce3a861a12fcfcbdde4
MD5 dc2dabfd9cbeadca467ec254d1aafed1
SHA1 4a5d38d07a76caa5aebcefc35c08835cd3ca32c1
SHA512 ca1fcd861919d31a9d216a638f4f4da142bc8c2d47a311ba2b69f53a8773e46bbb7b0f3dae3548ed3d391ebb20e5ba1de0b8a986ea1a088835558e6b025bc3db
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/us:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAB
TLSH
T15AA2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 46KB
SHA256 a4846ef904a50152c30a9b0d0221c19559502384f102c6f23621ad65b5115ebd
MD5 2c3bcbc3777012b7a1789c6767195fdc
SHA1 621a02da8d72274b7980b8657d6619537d06e82c
SHA512 246cf1d882a9591332fdeaf559d0cfe74b6bf98e50891731d02ed654f91e05a85a1716d66cf3eae828939edd336f0742ca96ba3911f42eb6667c8a9214c3d9e3
SSDEEP 768:PF8132wgHN+WyAerKHp5XSwQs88uBkiTpVaQwkzEk73r+QspMi:S13ks3rsILNBjVLzzF73aQsyi
TLSH
T1EE2338F998D3897AE8AE6383673D2E025DFCD123B4984584F7D81A0DCCA61BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 bc1c89f316192a988e2dfe47f4655b16ee52bc1dfa244437c54b726ce70133b9
MD5 eaf57c64e2ae289c6481f84c654fd297
SHA1 35480795010e8f27ef105a394ca2267227633146
SHA512 cd3511ec74cd0f51e90ecc68bc61f41995da84b20374100ab76d8581da0d644aaa4f58279ce2086af245d050ac24aec696ebea997e22c5a39f70d97806dbf642
SSDEEP 768:8Y3UN+jCc7fZrK2P0p5XSwQs88uBkiT2F2sp1o:8Y3Us9trxPaILNBU2szo
TLSH
T146F2BF39E8A49C73ACFA9385769737036FF46157D8C40B54C9EEA21E018375E274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 15e3b0b151db728a0fd308f20dafe2bbf81e383fcda08071b0a80d3dc0ec6017
MD5 d1345a5c3532ce684dedecbb0e0d6571
SHA1 c3f152f12361da9b81f9a2581261d24f82bc0acc
SHA512 b72a1e3009921420656d3025ef81b8bb6e5be0ef33ad7a9bf92ffbcc1150d37b41ef444a3db0dee01dc86a7921651f7b751b89c5007077662723cd8e6a7506ee
SSDEEP 768:G/UxvxjgC+T3kN+jCc7fZrK2PDp5XSwQs88uBkiT2F2sp0D:7Zj3+T3ks9trxPNILNBU2sGD
TLSH
T1EA03C03DF8989C23ACF69345368B2757AFF42567C4C40A68CAEEA60E01C775D274B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 aa0cb8e63a00cae16693c767e79dc713691a1467d9e89548e3af5a39c672c5c4
MD5 c4517bbdd5b7188de31c07e86f6c1570
SHA1 6e144016be6579845e137177fb902995a2295f54
SHA512 50441058bb6bc76fcf3840e4d7228001ced3b3093b28e2b4182382d2ade46bfe6a4a8a3ed9165d558375abfd40e1ee2a1f7d451b59d4078732be4f76b7481cf5
SSDEEP 768:Sx3UN+lCc7fZrK2PGp5XSwQs88uBkiT2F2sp1o:Sx3UsjtrxP4ILNBU2szo
TLSH
T16AF2BF39E8A59C73ACFA9385769737036FF46157C8C40B54C9EEA21E018375E274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a1ff26492a7a00cd3d52d58c8f35fe5086f9a8dd43ca282e89c9ad7f7c58e59c
MD5 f7007bc1b95689cb88992797977fb217
SHA1 a6a2dd6a713838c20f7fce63532594928648ca9f
SHA512 fe0153a76ab47018d44ad1284e780c56a90477493db6b6a0a210b8379a92c82febc519282dac7ec7264efeeb0367ef0b8564a02e0098784b3fb5c8fb0a12d87d
SSDEEP 768:R/UxvxjgC+W3V9yc7fZrKmp5XSwQs88uBkiTCo/P84g:kZj3+W3VTtr5ILNBdHg
TLSH
T1A203D039E8946873ACF39385365B275BAFF06153C4C41B9889EE7A0F028735D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0f6ed8b8b8c412411ab42df41848a580f91840951df73ddc323730d22961d9ef
MD5 880da2b2c2be3683398e726b6af4abaa
SHA1 d89c96caab2e17e510f6302e97f7f880c33c6404
SHA512 26051abee8560a2465495bdd4c1f58eac1cf99331dc76a6a78611b20247e8a87c6eea20d46eb32c925720576b843e193d9e339b10c64369f7c306ae73a1f0d13
SSDEEP 768:wx37N+lCc7fZrK2PGp5XSwQs88uBkiT2F2sp1o:wx37sjtrxP4ILNBU2szo
TLSH
T19AF2BF39E8A59C73ACFA9385769737036FF46157C8C40A54C9EEA21E018375E274B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9ff0218ed28cb0191bcdc3b103dcf50ba8f03d69856c0f16b5b57f6c2f60cc5d
MD5 be95b9b644387d93ff5601354ab7bc19
SHA1 e732441656c26858971ec730f1a4740725bdab2c
SHA512 beb04ffbfc8571de979270302ad3c26d8ec1f4a85a23b16f6a3e5edc2cb0464a9d6f358996cc7184bfaa5eb71526e1f9fb146e01bd000c7fa80e806944b1eeb0
SSDEEP 768:0137N+GCc7fZrK2Ppp5XSwQs88uBkiT2YSEk73r+72sp1o:0137sYtrxPXILNBfSF73a72szo
TLSH
T1DA039D3D9C948C7F58AEB344264E2B226EE82177D4F40A58C7D9570EC073A5DF747826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 f837a0be79824b3ec6f3abca5350dfc7c56fc8e114e0bd4f52c3f8136da186e6
MD5 2028f83487553bbb26a0fd35240568f1
SHA1 69311c7b88dbc2d714c63ffb128c45a77993a372
SHA512 95490eb641e7973f170d67b9ed8606a774fc9049b1eebba2eaed7a32b1d591f4a427c7054aa4f769a5d2d728dc5b311b3f09f16cb3c757d551de6ba9e2a7f2bb
TLSH
T1221110D14C3A1AC7C6BE0EAEA0872BEC04D86613B4983074188CF958903941E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

249f119b-12ea-4c4d-8441-eb989b9fa250.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\249f119b-12ea-4c4d-8441-eb989b9fa250.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4240_118541950\CRX_INSTALL\_locales\en_GB\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4796_1869310978\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6122.tmp

Path C:\Windows\Installer\MSI6122.tmp
Size 411KB
SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
MD5 1981cd407f5b5e81c70ba2729c56b381
SHA1 e0b6d311930ab3557d5a0a8769edefb49c32aa3f
SHA512 3b7c18ca780cf05a01062661156d71e0a4626469f28040e46f07c7deb8f9a643b838bbc88eda515362c5895171a337a3f5d9b8e321e539408fc1ae47e6ae4181
SSDEEP 6144:GDvoaVoIMrKAzCsTI+q6JL9eZYr1JJS5qZ47BwhYjzmHim:QvoaVo/2WCsT7pXJS5qgBwhYg
TLSH
T135947B29B3E418EDD4B682B6C5A78430FF75744D332095AF8BA4916D1F3BAA470BB701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e605ae6.msi

Path C:\Windows\Installer\e605ae6.msi
Size 848KB
SHA256 f59a0c4177cd57a71c99b22009131a3bdf898ee6db62ef0415f056c4b26bb53c
MD5 57a71197c3da73f5088600fe1315f870
SHA1 5ee2d560c4d70756e29cd7d065cb38fd8a750ac3
SHA512 df44b6deb6c72b0bf8de820767041a378e97e4994e95ce00b675676b3892803620d94373492a04a598dfef334f135152b267b175ca3148af10f8341a88024927
SSDEEP 12288:LBGQ4cABdUb/aVo/2WCsT7pXJS5qgBwhYA3hy6J:dGyASwoO2T7RgZMY0hy2
TLSH
T119055A1BBF9414A9D8A24EB1C5B78321FE357C082320959F46A4B12DDEFB6E0647B7C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e605af2.msi

Path C:\Windows\Installer\e605af2.msi
Size 28.1MB
SHA256 22319614080d76c82a33b196c5765ca70ff1f38041e907c7d5ed8775f6c5f3f6
MD5 4d24332e3f8bc0e2b708e5ef1a77c7bc
SHA1 c5719df9a461dbe3fcdc98fa124233c2ab9c40d7
SHA512 40b135e2e289067cbfb90f7f26cde73342411faa028533fb969effe688734c88ba19e2083040e62309011f81eb964c18b6017929a3a04b145c7677160163173b
SSDEEP 393216:H4lM4oYejHXelWkVUhg75WNLimpDkyBKuy75k9PX17foSjUQaoMU+//+tFwA/T/g:N487t5DkD+VJnixU+nuFP/mP1QgRvx
TLSH
T1C95733637FC419B9D8625FB6C0FB8751AE353C44236055AB42947269EEFA3E024BB3C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6672_279145393\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
TLSH
T17D31535723840B9306DA2B4566AEBDC4B0DDC02D7F27AE05186EF394537B52ED8B3443
MD5 SHA1 SHA512 TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{937EF873-846E-44CB-9C81-930AD4094975}\.ba\1036\thm.wxl
Size 8KB
SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
MD5 7673a053117454b94ff8155b9f06da1e
SHA1 2143896f16e8ec6d52eecb773e99d9a2f9daa4b9
SHA512 0d20a4d6819fc64e36cfcd9c029542d6ef834faa3c74dd636bc1b6697f92d8822cd19c1692c500956fdfe69a3278a84c0545c799878107d0d56520053b9ae266
SSDEEP 96:lsZt1vwZI+XNHwt/o5HezMxzMEy0vBW4eAQf49QcyhZpuWcK61xrG32gUgGv:o1wPWto5+zwzvWhvgYUgg
TLSH
T1E202105F58DBCFE06BB31717B6639589A839C286235F58E4F86B08078763914D337A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{937EF873-846E-44CB-9C81-930AD4094975}\.ba\BootstrapperApplicationData.xml
Size 9KB
SHA256 0da13bd67e88529919a3d066aa6767188b7b2b97e5dd1df2e3e1a83970c25111
MD5 6134cde82dee63b5cdfc38e7686622f9
SHA1 fcb0ab62a70f76f8ac704027ad1676080055edde
SHA512 f365db6d84c137b2257996bab84a923f7d90464416cb7605a80539fbc446e72511c7946fcb0eb496e790ce505c29d8ac5469fa6f047acf786149f07315b6fb85
SSDEEP 192:iFzanZTl6/wvRSn9Xta+ai2fZ8SsCsysz:3nFptsCsysz
TLSH
T10812E5512BFD0219F0F3AF48EFF6A4155A3ABD152E39C92D01211D0F49B2E819962FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{937EF873-846E-44CB-9C81-930AD4094975}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{937EF873-846E-44CB-9C81-930AD4094975}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{937EF873-846E-44CB-9C81-930AD4094975}\.ba\thm.xml
Size 11KB
SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
MD5 4329e418dc56b1386d7ea29a0dcfab5b
SHA1 58387f92e89ca21b4179fb697c7de9675c59142f
SHA512 6934873d27e6efbb94da4f13ee8369b29995490051016fdf82800256b924902306d328bf1d4ebbf266d1a53eb24adb6478d1a67de4ecc3e3bcbe561968f24922
SSDEEP 96:HgvPkoeWEH3IWTaQfSJgHzth5mFahbuB8pR5+Vpwe+UIJLg1gEp+6F5pQnxc:AvoWydmQfVHMyyj5Z
TLSH
T14B42FC6851DC7811C532D702AB9371D3FF12BDA6C6C85A58B48E256B1FF262028B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{937EF873-846E-44CB-9C81-930AD4094975}\.ba\wixstdba.exe
Size 431KB
SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
MD5 14e0c606e68508fa618bd5c514015577
SHA1 f8c28db9d2810e872f6ffe7607019851f250c5f9
SHA512 c29fedca692ca2f9c5e63f360aeb95399f2f15f1576a0d06fcf9f0919f6b658329973803bc870b0b1e954b0105757630ca3f4b3ac64f4b80e91742d612fd5b73
SSDEEP 6144:N7lQcp03E0PKVMP/PwMFJ3zdoZmb8LSQsCjzYkffTTp6EoNXJrprSU0e:Np6mM/wML3/QsJDLXJrow
TLSH
T16D942A3165F04023D6F94572E915FA30AF39F208670085EBA3C0DD297968AE6A7FB357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windowsdesktop-runtime-10.0.12-win-x64.exe

Path C:\Windows\Temp\{937EF873-846E-44CB-9C81-930AD4094975}\.be\windowsdesktop-runtime-10.0.12-win-x64.exe
Size 968KB
SHA256 08a7e2db64e2ed8f0c0476d4463af75e691d1db571a05de6e161ce0178fbce90
MD5 95f7a028a67ce1c82bc647d02e1f2d0d
SHA1 6facfe6e1234168184b3ffb62189e608040fd65b
SHA512 07c388e66f7c6d9e9c257fc595c6eb9da5f9b1647a52fa10c81e72a49ce2b714eaeae9b7a604fbda61ca7f1aa1ae6a9781c50d8ce5259164ce27b81281cea773
SSDEEP 12288://hzPsOEX5eZbWC1I0iqm+4/Pm0zykD7xd5DWs2DuHxXQPE4Z8ob:/ZzPRq5eZbpTh47zykJnDWs5NQ84Zl
TLSH
T1CA256D31A566242BE6F40973F914D6307E28E7082B1C45B6C6D0DD0C79A89FA6FF724B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download