Overview
overview
8Static
static
3SteamUnloc...up.exe
windows10-2004-x64
7SteamUnloc...up.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
8steamunloc...er.exe
windows10-2004-x64
6steamunloc...er.exe
windows11-ltsc_2024-x64
8Analysis
- max time kernel
900s - max time network
850s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 17:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SteamUnlocked_Launcher_0.4.1_x64-setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
SteamUnlocked_Launcher_0.4.1_x64-setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral15
Sample
steamunlocked-launcher.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
900 seconds
Behavioral task
behavioral16
Sample
steamunlocked-launcher.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
900 seconds
General
- Target steamunlocked-launcher.exe
- Size 24.7MB
- Sample261011-vw6ktsbv21
- SHA256 c920ce7952b95a74a50a352b252b68bd91dd347aee8674818f3277c17ddb0044
- MD5 71ecf1c24bc37a83d8247f02d8d356d8
- SHA1 28227886aa63b46d548cf179451878f6c045ecb7
- SHA512 a25f343db5d8a3d3f0860b4b3494967746f94c40a2527d29643297bb4fe86ad6cfc0cbf70fedbd7a5ee8f79354e8b88ca648fb3f20d716ae5606ee5919151f60
- SSDEEP 196608:vXPAsIh3FMwiFICQtK/NqZpC8t7siU+C:vFI5FF6Ic2C8KP+
- TLSH T167473915AA6B98ACC4ABC47082474A635E2130DB0B39BAFF45C457393F79BF46B39314
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA steamunlocked-launcher.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1841040277\Filtering Rules msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1841040277\Part-RU msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1874849207\metadata.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Mu\Cryptomining msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1466636558\ranked_dicts msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1874849207\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Sigma\Fingerprinting msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-lv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-nl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1466636558\test.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1568739753\_platform_specific\win_x64\widevinecdm.dll msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Mu\Staging msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Sigma\Content msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Sigma\Cryptomining msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-eu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1841040277\Part-NL msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1275265336\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-de-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1275265336\keys.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1466636558\english_wikipedia.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1831210762\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Mu\Other msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-te.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1841040277\Part-DE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-fr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1874849207\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Sigma\Analytics msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-lt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-sv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1874849207\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1466636558\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-da.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-hy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-ml.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1568739753\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-nb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-nn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1831210762\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-af.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Mu\Analytics msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Sigma\Entities msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-la.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1841040277\Filtering Rules-AA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Mu\Content msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-ta.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-bn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-cs.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-en-us.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1841040277\Part-ZH msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1275265336\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1568739753\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1466636558\male_names.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1466636558\model.markov msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1568739753\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1254857860\Sigma\Social msedgewebview2.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname steamunlocked-launcher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain steamunlocked-launcher.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{05D8C4F6-BEB0-47D8-8ECC-3560A2DA420C} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{828CD6FA-C9B2-4B22-961B-15DBF62CB2FC} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3564 msedgewebview2.exe 3564 msedgewebview2.exe 1168 explorer.exe 1168 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5032 steamunlocked-launcher.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1104 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe Token: SeShutdownPrivilege 1168 explorer.exe Token: SeCreatePagefilePrivilege 1168 explorer.exe - Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 5032 steamunlocked-launcher.exe 5032 steamunlocked-launcher.exe 3908 sihost.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 5032 steamunlocked-launcher.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 5032 steamunlocked-launcher.exe 5032 steamunlocked-launcher.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe - Suspicious use of SendNotifyMessage 46 IoCs
pid Process 5032 steamunlocked-launcher.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 5032 steamunlocked-launcher.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 5032 steamunlocked-launcher.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe 1168 explorer.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 468 steamunlocked-launcher.exe 3920 StartMenuExperienceHost.exe 1168 explorer.exe 3584 SearchHost.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 5032 wrote to memory of 1104 5032 steamunlocked-launcher.exe 89 PID 1104 wrote to memory of 2072 1104 msedgewebview2.exe 90 PID 1104 wrote to memory of 6128 1104 msedgewebview2.exe 91 PID 1104 wrote to memory of 6128 1104 msedgewebview2.exe 91 PID 1104 wrote to memory of 6128 1104 msedgewebview2.exe 91 PID 1104 wrote to memory of 6128 1104 msedgewebview2.exe 91 PID 1104 wrote to memory of 4108 1104 msedgewebview2.exe 92 PID 1104 wrote to memory of 2944 1104 msedgewebview2.exe 93 PID 1104 wrote to memory of 2944 1104 msedgewebview2.exe 93 PID 1104 wrote to memory of 2944 1104 msedgewebview2.exe 93 PID 1104 wrote to memory of 1172 1104 msedgewebview2.exe 94 PID 1104 wrote to memory of 1172 1104 msedgewebview2.exe 94 PID 1104 wrote to memory of 1172 1104 msedgewebview2.exe 94 PID 1104 wrote to memory of 1172 1104 msedgewebview2.exe 94 PID 1104 wrote to memory of 1172 1104 msedgewebview2.exe 94 PID 5032 wrote to memory of 468 5032 steamunlocked-launcher.exe 95 PID 1104 wrote to memory of 3780 1104 msedgewebview2.exe 100 PID 1104 wrote to memory of 3780 1104 msedgewebview2.exe 100 PID 1104 wrote to memory of 3780 1104 msedgewebview2.exe 100 PID 1104 wrote to memory of 2680 1104 msedgewebview2.exe 101 PID 1104 wrote to memory of 2680 1104 msedgewebview2.exe 101 PID 1104 wrote to memory of 2680 1104 msedgewebview2.exe 101 PID 1104 wrote to memory of 3564 1104 msedgewebview2.exe 102 PID 1104 wrote to memory of 4528 1104 msedgewebview2.exe 103 PID 1104 wrote to memory of 4528 1104 msedgewebview2.exe 103 PID 1104 wrote to memory of 4528 1104 msedgewebview2.exe 103 PID 1104 wrote to memory of 4804 1104 msedgewebview2.exe 104 PID 1104 wrote to memory of 4804 1104 msedgewebview2.exe 104 PID 1104 wrote to memory of 4804 1104 msedgewebview2.exe 104 PID 1104 wrote to memory of 5548 1104 msedgewebview2.exe 105 PID 1104 wrote to memory of 5548 1104 msedgewebview2.exe 105 PID 1104 wrote to memory of 5548 1104 msedgewebview2.exe 105 PID 1104 wrote to memory of 4336 1104 msedgewebview2.exe 106 PID 1104 wrote to memory of 4336 1104 msedgewebview2.exe 106 PID 1104 wrote to memory of 4336 1104 msedgewebview2.exe 106 PID 1104 wrote to memory of 2156 1104 msedgewebview2.exe 107 PID 1104 wrote to memory of 2156 1104 msedgewebview2.exe 107 PID 1104 wrote to memory of 2156 1104 msedgewebview2.exe 107 PID 1104 wrote to memory of 1324 1104 msedgewebview2.exe 114 PID 1104 wrote to memory of 1324 1104 msedgewebview2.exe 114 PID 1104 wrote to memory of 1324 1104 msedgewebview2.exe 114 PID 1104 wrote to memory of 5848 1104 msedgewebview2.exe 115 PID 1104 wrote to memory of 5848 1104 msedgewebview2.exe 115 PID 1104 wrote to memory of 5848 1104 msedgewebview2.exe 115 PID 3908 wrote to memory of 1168 3908 sihost.exe 121 PID 1104 wrote to memory of 1544 1104 msedgewebview2.exe 128 PID 1104 wrote to memory of 1544 1104 msedgewebview2.exe 128 PID 1104 wrote to memory of 1544 1104 msedgewebview2.exe 128 PID 1104 wrote to memory of 624 1104 msedgewebview2.exe 129 PID 1104 wrote to memory of 624 1104 msedgewebview2.exe 129 PID 1104 wrote to memory of 624 1104 msedgewebview2.exe 129 PID 1104 wrote to memory of 3556 1104 msedgewebview2.exe 130 PID 1104 wrote to memory of 3556 1104 msedgewebview2.exe 130 PID 1104 wrote to memory of 3556 1104 msedgewebview2.exe 130 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\steamunlocked-launcher.exe"C:\Users\Admin\AppData\Local\Temp\steamunlocked-launcher.exe"1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5032.4580.14196667374939912363 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView /prefetch:4 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffd50da5fd8,0x7ffd50da5fe4,0x7ffd50da5ff03⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:6128
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2196 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2252 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:2944
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3400 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f /prefetch:13⤵PID:1172
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3960 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4628 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3564
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4440 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4760 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4672 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:5548
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4696 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3980 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:2156
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4876 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4840 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:5848
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4808 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4708 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView" --webview-exe-name=steamunlocked-launcher.exe --webview-exe-version=0.4.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4764 --field-trial-handle=1732,i,4427563527306597984,12909626984471455560,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:86ec477061a9e8740d082a2ba5aaa0bd8ea1e76f3⤵PID:3556
-
-
-
C:\Users\Admin\AppData\Local\Temp\steamunlocked-launcher.exe"C:\Users\Admin\AppData\Local\Temp\steamunlocked-launcher.exe" --launcher-controller-worker2⤵
- Suspicious use of SetWindowsHookEx
PID:468
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2576
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1168
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3920
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4176
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:1280
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 607B
- SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
- MD5 76b78ed7ff6273215b134d6a6488035d
- SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
- SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
- TLSH T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\81f4b242-4848-4c24-bb59-8f1187eee0e7.tmp
- Size 3KB
- SHA256 b97de6ce027fef8362e09f7b88621b2bda1d4db2727103096cf21431a5069da2
- MD5 744cf3285160cc895c4d8e0a69a9e390
- SHA1 911535539d2865b2172be6e04035f615c9f531cd
- SHA512 8f893eb4c93809ae2f448fc4f4a7d0b507783c1b4baa3a94c422105ee7828879c85ea958f2d2856edd6a43f757d21a86cec61941b3bebfdfd01b27c8513d9398
- TLSH T1226197362DB4AA274EF29B58B9C73B12AAA55037F9817F94DAEC0F1C01D72D81341C5B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\91e07e71-1d8a-4066-bf55-a5c551ddd27c.tmp
- Size 15KB
- SHA256 4a8cdc98494c4fc91d7b226e78340d9d3d1707c277147df6c0cca1c2ec11d87e
- MD5 f990ece5e19cb8ef8fb03a92e9f03f38
- SHA1 5a7ad170b140a0a708ed0b2d815e487d4f09dc8a
- SHA512 9fc3ff568fc5411480d5280f4f7d4c3d502f56ad5fbe71936e497c9b1e8254dbc381b09386921352f00365cba244e4e3a4b7667edf2b880b49e21b3648474c39
- SSDEEP 384:f+aQikB+z/xvxjg/qhEU2NBSKOkHdlBMU5/Wvp9zt:u/UxvxjgC+PzizvpFt
- TLSH T18B729E2759B87E33A1F3F714BA59179BCAB89471A4827FA44AFD5F1902C72D80742C06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 36d1c52cc0fecdb91ff7e7554ba28e9ff69efa795d7af92c2889616a4298b427
- MD5 ddafae532612019b1808b28c1ff13192
- SHA1 4af933a7b44195ad5c8b21452c64dbe3ca4f93b3
- SHA512 03a103ba58576a04567d392adb2470e4649e507afdc62ab60f08525e7f78f318582cf86647a8b1b23cd49f90065b065503b10601a58f3bcb0e99c56c8f744c7f
- TLSH T1C6D0122632110738C81024330303654A1440D12B60058510983D9B5E5A450510D02841
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 07c803e18e9e2481308129b2461f4f0393e1612a83ee244f00ef659af516bf35
- MD5 160c38ec1ce1f1bfc18798160f07c6a2
- SHA1 7a867cf863a4f5088a8574ec295bcff6d4c99ec5
- SHA512 eb3b1f7a6b444a38460b685e8a03250e0ddf677fe688f23c4e326a5482609757b5b5de43725acc17cb9964c686ec34a5eb347658f0c001926fb18ff4100fa353
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
- Size 72B
- SHA256 1fa964881ab85564985321ddd3b829900a2c1ba397e8d01af9f98f3d455ed92d
- MD5 45365876b1010f70e729fc196cbbed21
- SHA1 9c22a9570d738a07adbca3b3abacc0c315ddae3b
- SHA512 50c27600e38f8ee9ddffcf40593896cbfe3caa5cef8f5ea73b5a901cd3bbbc52f496223143a0f740b15e0ca55bbd120529c4d95634f29eb145854608cecae7d3
- TLSH T13FA0029152800216D7141371B6E10D513A305D3686A376D3E0E82CB4CA507A48119041
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 1f3908e6cd8f24ac160c7ccda86b11557a52ca5ab07330a72ae9b261bedf4ec0
- MD5 c7f28a8e7b9b6d5ed395cc7008192e23
- SHA1 008b70dbbe5791455c53c479ae4a93a82a56118f
- SHA512 10a3e63e9683499b637c884c3a2df088994938a42d8efd56ab2c458eaf5476843de87e464dadb47c87752f758e148a05ca325cbcfa28c53a5d465ba6d4a1eeb3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Network\Network Persistent State
- Size 59B
- SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
- MD5 78bfcecb05ed1904edce3b60cb5c7e62
- SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
- SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
- TLSH T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Network\f189a606-62ed-454c-baf2-375fd11e9f52.tmp
- Size 570B
- SHA256 0a44394cdb7cef3005d61e9fab201acd2f2ef8a674546b029a18bf72a7416db4
- MD5 be6872ba029f2a55316cfcaa16e7f637
- SHA1 c2974cc0f3133fe9c0cfcd9a26f8b05ba08e0e30
- SHA512 a0e789ca02125bffd88d3f62e204c1f437003230e33f58e195eacc2deb2eaa7d84a1244cd55a63aeb5709f309641501cab8bc8790175adb863e63a22385b6e78
- TLSH T142F0C651C2E4D6BD4B5117E026353913C92E080B922C3D16DEEAF7EE57D20B5D13150F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Network\f6ef8004-5930-4cc9-be1d-6822d2cf7ad2.tmp
- Size 570B
- SHA256 a8ba456fa1261f89477d0ed8d92bcd90d6e95ea2f2b1933f2fff07654b832f9d
- MD5 2b31f0c8008b41ad4f70e1f0617f41b8
- SHA1 bd0effa5206f87f58a1bb286507b38178a34c0f1
- SHA512 d26c9ed04b1b0d9f186696d07f94c6bd7496e7c48ac7cab1158a13b6d1f6b351959607768d74fa0e44bd6b9e27418e2a80ecec0cc8429b5526a24a82260a6acb
- TLSH T1DBF0C651C1E4D6BD4B5117E026357913C92E080B922C3D16DEEAF7EE57D2075D13150F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\Sync Data\LevelDB\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\ace8bea0-027e-4c9e-bfb7-68b2fe1860d8.tmp
- Size 6KB
- SHA256 f265521feaa4b34fd85f4d5acda17ce5a827513b3c490800197ed45003982e73
- MD5 53ee0ba4df5067e75ec18f6bd48a63dd
- SHA1 45854ea908c53e774533f1e5f864a7659a2b5063
- SHA512 b42fb4796a3b84b0e81ce4f1db3abcd76f879c2fb9dd5e67319328d69df007ec1a53ffbb1fdbae7563b3dac2ce5d15a353f25ee2821e995bdef8c889142d54cd
- SSDEEP 96:stT/dzGPGHu/b9qkUo5h16Z0zs7/x+6MhmuecJAA1ejeUK+gn28XM1C7K:stLpxukJonzsV+FdAAQjABG6K
- TLSH T172D195025E64797B8CC6F259BB797A13D2F9607271D12E48EBF9852C04DA6DC2307D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Default\fa427be6-d753-41e8-bb83-fa71afd6bfe7.tmp
- Size 6KB
- SHA256 940e803ca3092cea57cc9354483deb96b8defe29db78d5e3fbf84ddd75aa7f5d
- MD5 33389691b19df995ee85505d2ad31515
- SHA1 bfd8ba7d6e483be35009a1a82c3c9471bb4ff5aa
- SHA512 fa72b6d2fdfd3a3c2c0f0b0c2a37b937c42e71ec7873074fb0ac07d5f3ff9f47741a907f4a1b7145236cfb8b7f2fb6b1d6f6d46e6154f7dfee2e0766f291031f
- SSDEEP 96:stT/dzG4Hu/b9qkUo5h16Z0zs7/x+6MhmuecJAA1ejeUK+gS28XM1C7K:stLpXukJonzsV+FdAAQjAAG6K
- TLSH T14ED195015E647A7B4CC6F259BB797A17E2F9607270D12E48EBF9852C04DA6DC2307D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GrShaderCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\GrShaderCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Local State
- Size 1KB
- SHA256 c4049d39d6dcb7d44840fc9a08dcc9478b9c823a99740c5a8a6803f446a55a55
- MD5 ff3e43f5b994af48f2dc3dc5a21eefeb
- SHA1 030303c1fce4ad357bf1de10067211a2d98c5ff2
- SHA512 c2e6c7537757ea82fd62d0c1429e04d048361e4bc651b0f40cca56b0ba9ab33155357992787e91d9d4fae70a63867c46d714d6d14b960eb250304f29cbca6bd3
- TLSH T1652195B25CB45B33ADA137A971D33AA78D30207A51009F0075EE4E2C01D65DDDA66D7B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Advertising
- Size 19KB
- SHA256 231be4e0be45f588b161634c816b9a5a49f530c0dcb55461d37715a94482dca1
- MD5 897eefe311c18078a34e06f3cf624a6a
- SHA1 98246e769fb513b8aead588024d1ceadc65422d9
- SHA512 0fad93ec06d6cadb4c2e72b3355b509d5b9995706d6b7e9e69df21d9907dd3d4156eaba62a6c64ed34a6747046ffff841cc79020aff0a29690258ab487bbd6cd
- SSDEEP 384:/j+Vafk2xyJEYoAYiQZU8rYvepdFhQXVVRwjSTV2quzxmVUiKF4EysZ4y5:zfEHoAYiQHriepdFWlVmjSTV2qwFOs1
- TLSH T16A926151887035622F2F50CDE0583F8E1199667540AEE6DE9FE48666F28C0F37894EFA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Analytics
- Size 3KB
- SHA256 bba2063d20d70f4ab06dc2ae04c2564cc2b8c631b6dab68248957dbdf107fdd2
- MD5 b55f84fa839160086b8b337b59f80ded
- SHA1 0fde6cb65ef56264517aab0eb5ea93667f5985c2
- SHA512 6750626e0efca608abafe63926229887a68c9f3e657cb78921daf9c6b3ce11d6bfe1ba83fac775a8d1b6b69cbc00dc193fcb818c70ded3ea159b6241fd2823ce
- TLSH T1CF815415A4A014433E2E5668E03C76B912E8253880E9FBD9EFB19965F30C0D778E597E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Mu\CompatExceptions
- Size 689B
- SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
- MD5 108de320dc5348d3b6af1f06a4374407
- SHA1 90aa226d3c9d50cf4435ecdd2b8b0086d8edeb8b
- SHA512 70f30c45e20b7cddd0cba6476af9338975cec8e40b8b19603af5fa859a34c6eb2138957daaa263633fe65213e2186402d05d9d29ad53e8f311335555116314c2
- TLSH T1E101E6F18EBD58313C74967C876C0E8FB9A5636F2898F2E96502CC87E3C054761A6C78
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Content
- Size 4KB
- SHA256 9a63f38e22b8573cbd47a4ef7b67ccb0934b87239e075c5cfafc7a1014e340c6
- MD5 0e3ce75aaf5e674dcd7508251bb839c5
- SHA1 35d4a84a8d946263e6b1d06fadc31c5753a946f0
- SHA512 80d49bfdbcce2ac21c5c39c6c538135a9768b5fadd73137f6b5916fe6740827fda06c154508c0f9810723c397a22f3d93542f3e972ed3b736f7478ea2e6dc0a9
- SSDEEP 48:lAHJBLfUUIAPMsb2zIEcySe00woiyKIdw5uZWhDNB+jS+3NrSA6CdM+3+1oH:lApdOAP7bercySB/1ylw5usB+WB8x+yH
- TLSH T13991B7037E4409276E95D105C0ED209E2C71ABB0C85DEDC99B964B7FBBC8C8BA4961FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Cryptomining
- Size 552B
- SHA256 bdee796bf07922c152d770cd5928955f1b12c12515c4db6fc0ab8d2ad0c44c4e
- MD5 39461c6ea4ff09d663a65d133eb47c98
- SHA1 c41f5b5ac9a202ec7dd12122e64b858379a9a815
- SHA512 a8e195fb9bfa68dbb064a0f8a41cd86aef5fca43349388294d364b5fd556f0a01674bffcbb5eb2a36e3fea9c64bf575b5e7ed674661dcb7544ed7a961686d4f8
- TLSH T14AF0C0E5C82197766FD544A1E05E7389F4844BB26094F3D50B56321996E8A432684DEC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Entities
- Size 68KB
- SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
- MD5 478a605d5578236f2d1ddc93c2f22456
- SHA1 917f05453d497b3e3de684a905e141972c34a267
- SHA512 26d75309976fac0bd03ffe7596209c50ead7518584dd9f27d12a86d80ecec0889bb58da1b8dc8cdb38fc6bfdca7928a54c5a15903c4b8d293633d4d58ec147b5
- SSDEEP 1536:Wz20p1W8VMVLwecMFUh+oP9jt1PNEOjy+in:W2W1WUMzUT1jpw
- TLSH T152630877BC500D3384FB804BB09D2D6C21249FE5D8ABFED89BB1516612839C4B5D86FA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Fingerprinting
- Size 1KB
- SHA256 05b29240a28bb75b4535d558edc510eb92df0ac27e9502498b99cdbc576b8298
- MD5 f665b35df3c2a7b4efd9dc396f2af9bf
- SHA1 2833c37d7d92a4cd1e413eba0d6717e90e69f973
- SHA512 e7930341af55bae220962d79ce9aa056bbd1c9fe3cfaf0fd4181d9aa4257b5679648e4aa19561c2f9b5c8fcc6e6757d3616726eb28e77a2b899fa25f7d1b6706
- TLSH T1DF211F8295D038716E6E1488D55C3F9C129A2B7001E6F5DCCEF486A1B61489F7180C67
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Mu\Social
- Size 754B
- SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
- MD5 1d06d58fe9131c14ba5ba5ff740b020f
- SHA1 e6ed812e23e201b20170e928686a5d612165df85
- SHA512 2854c73c6ef4d271d0e992113732ad65e406d6310711551952b4d451e2c577a2c3dcb06052e3ab30003b01619a39e87e5dd28d54f459f94efe879d1a79039b8f
- TLSH T14E0126DB1A1450027FAAC495E4458B6948B00630445DFDE582B8D27BA08EC97F39F7B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Advertising
- Size 21KB
- SHA256 5c62ee354070033dba1bad40dcde115a81db45943b2274fae7059a5aa5c61d33
- MD5 452f3e9d40539cd65cafbd008308b5b8
- SHA1 34203b4a803009ff56bb28d3a14305348082990f
- SHA512 08504c06b603db3cb12f0ed6e30e733c2a2c830cad1124771c64b0e7b8480113383440325c56116fb57bde458b393ce182a3af75f0cef146ad6a8872ab9a964b
- SSDEEP 384:oQh4q3kwr8CPLo3AptN7NoTn5LTDq3ZXmRHAez/GRQMKWxV1R:wqRr82LKAptNJoTNT2JXm1AezO2MKWx5
- TLSH T16CA2B361996025513E6F009DF1993FCD5AA8233080E9FAE9CFA0C676B35D4D335948FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Analytics
- Size 3KB
- SHA256 d303be86132f8d7131941d41736694c2e29647ebaeccb38c0976fe66616ec8af
- MD5 c4c782264f4a6a6ba84801c8c148afdd
- SHA1 f138b8f526133c5dd612f79825f4706569fd18b2
- SHA512 e1d3b123a7eabfe72d4df981e1015ca616c51fe7d94de91223e9c7f4eb98ed7d3ebcf7b5c7e08579db502c7b3529e095d314dc71b8cf5e79081c678e73aa646e
- TLSH T1F261C814312434212E1A126ED55E3E8E6AF8223904FCF7E14FF18A71B2194DB38E873B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Content
- Size 5KB
- SHA256 70c295600066e9d3feeacd6bfc735bbcac6243694e4259477822d3db252729e1
- MD5 7c5f5e42e885211f783a06b1317ba145
- SHA1 079ab890b012120b89f776e4bfe67f3789f67096
- SHA512 ec581f41917ee010d71a021cf16648fa757327198113dc3daff3adb33ee739da3f40d87a6f3e49004106770ea705e6b800fe263d21eccd33d7883fd1ed8c82eb
- SSDEEP 96:02KCCvwLR/tE1LYSeyTPXD7fOiCrC400uvuJEjchVEy8Upy4uILrqNaRq3:02KCMwtWLYSe8miZHvui68kRBg3
- TLSH T169C183B2495079522F3E01C6F9E6265488E483715CBEEBC787E0C62CDD0E9E335A835B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Cryptomining
- Size 32B
- SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
- MD5 4ec1eda0e8a06238ff5bf88569964d59
- SHA1 a2e78944fcac34d89385487ccbbfa4d8f078d612
- SHA512 c9b1ed7b61f26d94d7f5eded2d42d40f3e4300eee2319fe28e04b25cdb6dd92daf67828bff453bf5fc8d7b6ceb58cab319fc0daac9b0050e27a89efe74d2734e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Entities
- Size 128KB
- SHA256 a5409d2c6a8cbd9339a95a5e09fcaedd4546a49d47fc4ebeda2d8749cfc66987
- MD5 87b4b75312dedc7106ac746153153c1a
- SHA1 54fd4b67eb16620ce0dafe8eb641f6a256dfc4f0
- SHA512 f594a5039c73db236f97dd50c3eb007f2fa2ff44d558222cf983dcd703d89f9b1e832bd3c249a20bfa592656e9c2e61a41f90df1b927fdd8f490d36734f92d30
- SSDEEP 1536:e9nKLDxqghS81HcmcgqPvD2E/FwoqtK1Gmbpq6CXkkqGqnuP7Sr:GnANN1Pt3/oqtKAWvCJqGqnuPK
- TLSH T1A8D30938FE60C8185CEB041B91296DDC5B801BDA5AA6FDC9EF7F78190242DDD33285B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Fingerprinting
- Size 2KB
- SHA256 5306139881e81eebffd97de016130fdbb04e3ae976d94ad7a74e5dee63fbafcd
- MD5 427724f72baa3d5c91671853a89245e5
- SHA1 a33deaa88143c298e0732ecb233663c372cb0e2b
- SHA512 bd0027e9bd25fa3426dfe85f67bac14bc3124bbbd6493c1d1aafc33343dcb008a8a418134deda235b71377ff970fcdc45ce4e6b1eae79fd3adf1bc3ba2e2103e
- TLSH T19441552354202051BEBD498CF59A3F4D29E5623984DDF6D5DFE08936721A8E734908A7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Other
- Size 34B
- SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
- MD5 cd0395742b85e2b669eaec1d5f15b65b
- SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
- SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Social
- Size 3KB
- SHA256 28ac79097cf67587a228fdfe4746a1a9b31dae94d5a63bb3fcaa82443d69e7af
- MD5 af4c6f2598c45087a32c4f410f242553
- SHA1 cad2a50e20ee6f699e21e78c58991a6a25a55ec0
- SHA512 7d378b90e3cb7feac3580bc7858b6d8a4967c77196be5b7d94ef076a7e1e8166156e62954998fa6931593db5c8a8dcaacdfe3421bd39e6517f6c6094caf4f4a1
- TLSH T17B61DC32C550A9932E5D0C81EDC55E704DD8067ECCA6F4E287B082F8F0AD8977D90BAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\Trust Protection Lists\1.0.0.38\Sigma\Staging
- Size 1KB
- SHA256 f90f4cb0976a046e93978971b58fba24bc93b0129e8612fdd0e5646a1bebed22
- MD5 5d7f5a0c242d9d1290c8ad0bd57be3e7
- SHA1 d454811443284aeaa0294d30caf65e624182b150
- SHA512 5d36ffb2ec4d162c49e5dd1207bee8b51f36d91ab38d23ff85d4467ced3a7e0f4f639b230623804260d8b03e49ef124e6ae9714f63c896c024215bfbd13dbc88
- TLSH T1A621E2194E908CB11E596745D20A535ABDEA617D38E7F4CB8EA8DE7FC2CE85702344A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.uploadhaven.launcher\EBWebView\e73197bc-8bef-47a2-8f4c-7923f7986d1a.tmp
- Size 2KB
- SHA256 b17d1d4cd32fb92b2aeb10d14c043a32b7eb16c47e853c1f61cac9f0b6782698
- MD5 fcca7363ef490edd1c1de5a3f00fdb6e
- SHA1 de4eb829f24011bab9524fd713597909bf0d696c
- SHA512 093c32a5b26473874c1f03e4b4db8240443f894ab536dc6fa34154e3622d4866ab5603a8cb9ea2a5efd766e649228d803a5d2fbc19266c9d43cde0ef7b8de52c
- TLSH T1C45184732C64AB338AF26B5879973B22CD356065BA523F50AADD0B1C00D65AC1742C6B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\com.uploadhaven.launcher\catalog_sync.json
- Size 11.9MB
- SHA256 fd59931702d5400e60b3443bdbecb23f875a6b071f07c12f4d36880a7e16c64c
- MD5 457af3eabbca2ed3606b74595451033d
- SHA1 57b931711298c573a54cfb3a483b1334cbda0e51
- SHA512 506eff4c328132c5f7a89d4c250d9d31c98c20a51fa02dfbe5fd6b3b5d0f40673bcf8cb9df9f4d45d92342ed6a5fe1d90863c90de1790c5b8ee2e76b747a071c
- SSDEEP 24576:Sqg2zcjCnifaarCJJdNMGssmgAxqOm1cwSs+VhTIhFvp2mSjVIzRF4LeWD3q/D5d:SqcjC3nFNMGJmgRSzIfwZgDRW0P
- TLSH T1E9C6F27BD0148C6533294A689CDE60872350430B0ECD7E44BF5DD28DAF6EA2D62B796F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1275265336\manifest.json
- Size 78B
- SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
- MD5 259f068207f60fb9d4448c02c27b74ba
- SHA1 99131d95cce94750a928738a99caa5c710bbc924
- SHA512 fa41eac9d1ca244d06083e3d4230dd94700861155359722c1d815d0d9933dcd39c113b6f0f6ea02ff7ee1acd2fbc6ed40267d557afde16f417e80b678e8136bd
- TLSH T173A02230AC02E23320C803B002B083C383A02C02302A388C0B0320A232C823BE2F323C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1396687411\manifest.json
- Size 113B
- SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
- MD5 7ef3c71464d0fef472bc1d81fd363c62
- SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
- SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
- TLSH T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1424633238\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1466636558\manifest.json
- Size 69B
- SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
- MD5 fb0d9796a86299d3689982f7a949dc6e
- SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
- SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
- TLSH T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1568739753\manifest.json
- Size 1002B
- SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
- MD5 9be87722ce3608a2d38a79079feaa394
- SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
- SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
- TLSH T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1831210762\manifest.json
- Size 135B
- SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
- MD5 616eb6b585f16811dc5db5063e088cd7
- SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
- SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
- TLSH T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1841040277\manifest.json
- Size 116B
- SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
- MD5 daf93729356a67ea1f849554827fdab1
- SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
- SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
- TLSH T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1874849207\manifest.json
- Size 108B
- SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
- MD5 8e9357dbfee2ec0378af047a76d0b453
- SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
- SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
- TLSH T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-as.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-hi.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\hyph-nb.hyb
- Size 141KB
- SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
- MD5 677edd1a17d50f0bd11783f58725d0e7
- SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
- SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
- TLSH T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_1982512488\manifest.json
- Size 82B
- SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
- MD5 2617c38bed67a4190fc499142b6f2867
- SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
- SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
- TLSH T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_368150552\manifest.json
- Size 76B
- SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
- MD5 ba25fcf816a017558d3434583e9746b8
- SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
- SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
- TLSH T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1104_404823434\manifest.json
- Size 102B
- SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
- MD5 19322c8a94f1ac01a70f8c58cdbbc720
- SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
- SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
- TLSH T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
- MD5 SHA1 SHA512 TLSH