hxxps://cdn[.]discordapp[.]com/attachments/1554647053500551188/1560021760592847019/Anubis_Beta_0[.]9[.]9[.]1[.]jar?ex=6ad7ca7b&is=6ad678fb&hm=be8822da477c1fa1bb24c6c1ec71c022c42e5d4616ee707845625248a76f26c4&

Resubmissions

20/10/2026, 15:06

261020-sgsdjse17m3

20/10/2026, 14:06

261020-repdfaew9q7

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
1469s
max time network
1355s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1554647053500551188/1560021760592847019/Anubis_Beta_0.9.9.1.jar?ex=6ad7ca7b&is=6ad678fb&hm=be8822da477c1fa1bb24c6c1ec71c022c42e5d4616ee707845625248a76f26c4&
Sample261020-repdfaew9q

Score

7^/10

discovery ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	javap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	javap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	javap.exe
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	javap.exe

Executes dropped EXE 5 IoCs

pid	Process
4712	javap.exe
2860	javap.exe
4568	javap.exe
2944	javap.exe
1164	javap.exe

Loads dropped DLL 53 IoCs

pid	Process
308	MsiExec.exe
4712	javap.exe
4712	javap.exe
4712	javap.exe
4712	javap.exe
4712	javap.exe
4712	javap.exe
4712	javap.exe
4712	javap.exe
2860	javap.exe
2860	javap.exe
2860	javap.exe
2860	javap.exe
2860	javap.exe
2860	javap.exe
2860	javap.exe
2860	javap.exe
2860	javap.exe
2860	javap.exe
2860	javap.exe
4568	javap.exe
4568	javap.exe
4568	javap.exe
4568	javap.exe
4568	javap.exe
4568	javap.exe
4568	javap.exe
4568	javap.exe
4568	javap.exe
4568	javap.exe
4568	javap.exe
2944	javap.exe
2944	javap.exe
2944	javap.exe
2944	javap.exe
2944	javap.exe
2944	javap.exe
2944	javap.exe
2944	javap.exe
2944	javap.exe
2944	javap.exe
2944	javap.exe
1164	javap.exe
1164	javap.exe
1164	javap.exe
1164	javap.exe
1164	javap.exe
1164	javap.exe
1164	javap.exe
1164	javap.exe
1164	javap.exe
1164	javap.exe
1164	javap.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
163	3372	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIBF9A.tmp	msiexec.exe
File created	C:\Windows\Installer\e67a838.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e67a83a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e67a838.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB5A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{285FFC48-F0BE-425E-9496-8F5E267BC34D}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4976	msedge.exe
4840	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e01e56c99d3b8eb00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e01e56c90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e01e56c9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae01e56c9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de01e56c9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javap.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Eclipse Adoptium.jarfile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\.jar	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\.jar\ = "Eclipse Adoptium.jarfile"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Eclipse Adoptium.jarfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Eclipse Adoptium\\jdk-21.0.12.101-hotspot\\bin\\javaw.exe\" -jar \"%1\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\.jar\Content Type = "application/java-archive"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Eclipse Adoptium.jarfile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Eclipse Adoptium.jarfile\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Eclipse Adoptium.jarfile	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{0540EF6A-2504-4701-A832-474BAA48EF25}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3992	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
780	powershell.exe
780	powershell.exe
780	powershell.exe
1460	msedge.exe
1460	msedge.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
2104	chrome.exe
2104	chrome.exe
4028	msiexec.exe
4028	msiexec.exe
2712	powershell.exe
2712	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2644	OpenWith.exe
1868	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	powershell.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe
Token: SeCreatePagefilePrivilege	1688	chrome.exe
Token: SeShutdownPrivilege	1688	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
2656	msedge.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe
1688	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe
2644	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4016	2656	msedge.exe	84
PID 2656 wrote to memory of 4976	2656	msedge.exe	85
PID 2656 wrote to memory of 736	2656	msedge.exe	86
PID 2656 wrote to memory of 736	2656	msedge.exe	86
PID 2656 wrote to memory of 736	2656	msedge.exe	86
PID 2656 wrote to memory of 4172	2656	msedge.exe	88
PID 2656 wrote to memory of 4172	2656	msedge.exe	88
PID 2656 wrote to memory of 3676	2656	msedge.exe	89
PID 2656 wrote to memory of 5004	2656	msedge.exe	90
PID 2656 wrote to memory of 3676	2656	msedge.exe	89
PID 2656 wrote to memory of 3676	2656	msedge.exe	89
PID 2656 wrote to memory of 5004	2656	msedge.exe	90
PID 2656 wrote to memory of 5004	2656	msedge.exe	90
PID 2656 wrote to memory of 864	2656	msedge.exe	91
PID 2656 wrote to memory of 3868	2656	msedge.exe	92
PID 2656 wrote to memory of 864	2656	msedge.exe	91
PID 2656 wrote to memory of 864	2656	msedge.exe	91
PID 2656 wrote to memory of 3868	2656	msedge.exe	92
PID 2656 wrote to memory of 3868	2656	msedge.exe	92
PID 2656 wrote to memory of 3784	2656	msedge.exe	95
PID 2656 wrote to memory of 4044	2656	msedge.exe	96
PID 2656 wrote to memory of 3784	2656	msedge.exe	95
PID 2656 wrote to memory of 4044	2656	msedge.exe	96
PID 2656 wrote to memory of 1732	2656	msedge.exe	98
PID 2656 wrote to memory of 1732	2656	msedge.exe	98
PID 2656 wrote to memory of 2676	2656	msedge.exe	99
PID 2656 wrote to memory of 2676	2656	msedge.exe	99
PID 2656 wrote to memory of 2676	2656	msedge.exe	99
PID 2656 wrote to memory of 4008	2656	msedge.exe	102
PID 2656 wrote to memory of 692	2656	msedge.exe	103
PID 2656 wrote to memory of 4264	2656	msedge.exe	116
PID 2656 wrote to memory of 4216	2656	msedge.exe	117
PID 2656 wrote to memory of 5052	2656	msedge.exe	119
PID 2656 wrote to memory of 4336	2656	msedge.exe	123
PID 2656 wrote to memory of 4336	2656	msedge.exe	123
PID 2656 wrote to memory of 1460	2656	msedge.exe	124
PID 780 wrote to memory of 4664	780	powershell.exe	125
PID 2656 wrote to memory of 4408	2656	msedge.exe	126
PID 2656 wrote to memory of 4408	2656	msedge.exe	126
PID 2656 wrote to memory of 4936	2656	msedge.exe	127
PID 2656 wrote to memory of 4936	2656	msedge.exe	127
PID 2656 wrote to memory of 3064	2656	msedge.exe	128
PID 2656 wrote to memory of 3064	2656	msedge.exe	128
PID 780 wrote to memory of 4840	780	powershell.exe	129
PID 1868 wrote to memory of 3992	1868	OpenWith.exe	136
PID 780 wrote to memory of 4528	780	powershell.exe	137
PID 1688 wrote to memory of 4556	1688	chrome.exe	140
PID 1688 wrote to memory of 4840	1688	chrome.exe	141
PID 1688 wrote to memory of 3812	1688	chrome.exe	142
PID 1688 wrote to memory of 3812	1688	chrome.exe	142
PID 1688 wrote to memory of 3260	1688	chrome.exe	143
PID 1688 wrote to memory of 3260	1688	chrome.exe	143
PID 1688 wrote to memory of 2372	1688	chrome.exe	144
PID 1688 wrote to memory of 2372	1688	chrome.exe	144
PID 1688 wrote to memory of 4048	1688	chrome.exe	145
PID 1688 wrote to memory of 4048	1688	chrome.exe	145
PID 1688 wrote to memory of 2440	1688	chrome.exe	147
PID 1688 wrote to memory of 2440	1688	chrome.exe	147
PID 1688 wrote to memory of 1112	1688	chrome.exe	148
PID 1688 wrote to memory of 1112	1688	chrome.exe	148
PID 1688 wrote to memory of 1876	1688	chrome.exe	149
PID 1688 wrote to memory of 100	1688	chrome.exe	150
PID 1688 wrote to memory of 100	1688	chrome.exe	150
PID 1688 wrote to memory of 432	1688	chrome.exe	153

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1554647053500551188/1560021760592847019/Anubis_Beta_0.9.9.1.jar?ex=6ad7ca7b&is=6ad678fb&hm=be8822da477c1fa1bb24c6c1ec71c022c42e5d4616ee707845625248a76f26c4&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffb90f7c188,0x7ffb90f7c194,0x7ffb90f7c1a0
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,9616692910189126926,7678809992086233675,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10604947216229451621,8661364093292278626,262144 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,5376049985161265839,4372252991674589211,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,6520477344427897445,4763589553231382177,2097152 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2403243825428050840,5473776354701977539,2097152 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,11855820713909311247,13973129262952806027,2097152 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,5361462342643427850,17623983549217645071,2097152 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,8772241590796199910,18167577296074090999,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,7734728274847203710,9574899042146253087,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,7876288055811374500,17568478321670559482,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5700,i,4132188721048302133,13213419624537992857,2097152 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,8044841228757555629,9431041772875848394,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,8044841228757555629,9431041772875848394,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,2106926181242855642,18339455528169114941,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,10408879699723956819,4535625044140714507,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,6622698607296602751,12974145536277574122,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,5906939541869098748,10432741334063281532,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13120171958908027897,173588137781621515,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6744,i,5905976435179106392,507733821213716053,262144 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,17975676136634823714,12124068086839041364,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,788851423408227541,550296895483299002,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,3648341112593556305,14295642669959153852,524288 --field-trial-handle=2308,i,372438065794579267,1452847407534203618,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\system32\tar.exe
  "C:\Windows\system32\tar.exe" -tf "C:\Users\Admin\Downloads\Anubis Beta 0.9.9.1.jar"
  2⤵
  PID:4664
- C:\Windows\system32\tar.exe
  "C:\Windows\system32\tar.exe" -x0f "C:\Users\Admin\Downloads\Anubis Beta 0.9.9.1.jar" fabric mod.json
  2⤵
  PID:4840
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
  2⤵
  PID:4528

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\fabric.mod.json
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb8ebfc728,0x7ffb8ebfc734,0x7ffb8ebfc740
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,7286459584429553575,10019267447189679915,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,4539755598392566090,11528899366945135473,262144 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2448,i,2419144369538604763,392696119001678882,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2460 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3140,i,5568361304291331859,8319229356830551816,2097152 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,17924560258515849801,16351457886275223504,2097152 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4616,i,53440941564775757,3398764998807518608,2097152 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4496,i,4183904836624427657,14898315349736250494,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,17603517082650787288,17533885292217384274,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,12845738498118938161,18403018375756806323,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,7557508009672882071,13263227954800137539,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,12282376054428660773,4878843406016445174,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5800,i,15849004311677278966,2610207964396345624,2097152 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5356,i,14193816975380297482,1951814446960426039,2097152 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5364 /prefetch:2
  2⤵
  PID:628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,17629418792733030260,17744975610392625506,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6192,i,2046944671813329194,11130904121982723437,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,2790346616152032499,3557205118627181811,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5992,i,13796048701639200708,1291929062812086568,2097152 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6016,i,627793062968555366,8406552110502118742,2097152 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3260,i,12717890607838141451,8715696174477371037,2097152 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2412 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5756,i,10643095031986128057,671725997625476939,262144 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,16365450940252115783,9943405124212377685,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4480
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\OpenJDK21U-jdk_x64_windows_hotspot_21.0.12.1_1.msi"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3148,i,11177037980824829313,8375835895220848041,524288 --field-trial-handle=2044,i,9299300704854519978,10379570339956868320,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:4740

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:816

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4028
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4912
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 985F4423097DAC1A163F40B2E98833DF
  2⤵
  - Loads dropped DLL
  PID:308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2712
- C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe
  "C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe" -version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4712
- C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe
  "C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe" -cp "Anubis Beta 0.9.9.1.jar" -c -p net.anubis.bootstrap.AnubisNativeBootstrap
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:2860
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" boot.txt
  2⤵
  PID:1148
- C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe
  "C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe" -cp "Anubis Beta 0.9.9.1.jar" -c -p imgui.AnubisAndroidNative
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4568
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" native.txt
  2⤵
  PID:5036
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" scurt.txt
  2⤵
  PID:2984
- C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe
  "C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe" -cp "Anubis Beta 0.9.9.1.jar" -p .net.anubis.client.AnubisClientMod
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:2944
- C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe
  "C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe" -cp "Anubis Beta 0.9.9.1.jar" -p net.anubis.client.AnubisClientMod
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:1164
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" main.txt
  2⤵
  PID:1016
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -cp "Anubis Beta 0.9.9.1.jar" -c -p net.anubis.client.AnubisClientMod
  2⤵
  PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e67a839.rbs

Path C:\Config.Msi\e67a839.rbs
Size 127KB
SHA256 5b313a6748630568939dddc08029c3e439ea1419376c33dc03ec5af30281d5f6
MD5 e8dd9bc4c2a648bb115a0ed459f053bf
SHA1 36f2ce0370542da932dd1181aae70072b5cf239a
SHA512 43d439f1338f299796952d3ee1da4f201651499f98899f5223556899643e243ff79b359db3aed84611621c2bf897186140fc3e4ff0694cc74c962ee8a7256596
SSDEEP 1536:CG0TOQbcr1f5xBcswf+BazAlmgjDJVumSyEsvnHxhoM5FEyKlHdf3dastOs/N7Ew:Z29E8Y1QHKLPY
TLSH
T1B5D34595ECB0D4D9E5C327665BA0E02CC1D02C2E6B4E181D77B985BFCDA79CBD2E9804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 f638ebab5787f0a866376270f9da387525edb2f9dcea7d199a195cc25ee9f34e
MD5 20ef30c31ff4c5938ec55d569d948547
SHA1 4f837cec8a15c9c97d0847befe2de336d331ec99
SHA512 bba2a35076b34e03b8d7497bce7c0e9bd0dd6ad686e20cae4ef26f4f384ba044af42ce8c83a2b9a2d056c98f4fa54701f83d458f08d6ecc65759118fc3e6c8c0
TLSH
T121F0DC630CAE24A1080588D95EA64E9430A2358AC8CAE82374F81CF3815F7F7590A102
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0B1450752E8709914F773207984E4A63

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_0B1450752E8709914F773207984E4A63
Size 727B
SHA256 7fc47c4e3be1f22e5197f287f9ca59c4ddd62e56053837ac824a06bc8351ccb2
MD5 bac19cc1dfed7c5350635baedd090c87
SHA1 d1269fdc935bb30567305653c15aeb9d23f19e4f
SHA512 baf4b6b35524b92c3082324b4d48d5f6542fbdd1229f40645f4b29a4ffa977bf7c66e6d91de873b58bfcf1b36fa33331463022d438ad85b6247c134c4aaac2e4
TLSH
T113019989D8EEB501DD824D5C8E250750B510443363CE009A343D0B55E6C27B31F80E3E
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 c7ee00eb60772fca16236a7e5c8742754ac233935178d5f415ac084d693072a5
MD5 7982038d7bf16aa1777ae5080a014f95
SHA1 46baa89d08fb20bf48c453a845ea191b57ca246a
SHA512 9ba5278b12fdc44bfdd1a45f6731b53f3ac7c5bee74f1eec4bc6af92a7816bec71ecaeb33fd47180a63778e0b47caf7bcea4135ce72acbe3dadeea0fec8f7c91
TLSH
T1A8019422B1AD2D62FE144E87C28DC9FD341372AA8095D0033BDE42EE559435BAA87D4A
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 2fe1b6e3361414cf32581eda30adb0c19f848ba5af2716dca224b57e9d867790
MD5 3cf34927ee0caea67abdf61d6416c7ce
SHA1 bb2a1e421b0de2d0967b9a8d437cc5049e16d83d
SHA512 9ec71ce1164b4d4c32a30da02b3746716fabe8653f337ec74f0e46ca163fde03b080f56d1946b3dfc3412b1e720961eca596a29bc4faa281fb5609948399a409
TLSH
T1E2E0C63027FB002FF2A0AF3803D5A096AF2AF0132C5852BE0F83001D9A0AE100CE2C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_0B1450752E8709914F773207984E4A63

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0B1450752E8709914F773207984E4A63
Size 408B
SHA256 931872bc07ecc3273dadce67e3bc83cd216da30959aa02310e0ee2c30cc781d9
MD5 759d328d0feab5bcc410ad1ca36c35ae
SHA1 e02b6d4932753d6c2dc0b3e0e8325b9a67a8dee2
SHA512 0cd6f882e242d3bb8e7ae64d8d3d9f831f9ae783405cf71055769d9f71f8cb7da2548a66727e88d0a7af0006daa3937604a163c0a3b328168a03cab1dcebb2ad
TLSH
T139E02D3432F7489FF3E8E43802FF6E23A90DF3070401C2BA0A40631AAE36B404CE6624
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 68b8cef4b0c977a04fa6b1728cd8b38eac454635750c274224e0821263205da5
MD5 64134b011d35769ad2a35422254b0345
SHA1 28990b4d35f577a0a90cce811dfcd6ebc26c639b
SHA512 6884a6098057b157f659b0c4bd58bc9714f94dbf59a6e3b6429e9cd73515eeb094421832c29ec8b79593041d81976678f2e3e3c5b54e6e06765bec27387a05ef
TLSH
T142E0682C11AB600EF090AC3846E6A1760D49E2151044D37916D0030DAB0FE005C10DB0
MD5 SHA1 SHA512 TLSH

Submit Download

19540593-e7ee-401b-a62d-97a6120a4fa5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\19540593-e7ee-401b-a62d-97a6120a4fa5.tmp
Size 130KB
SHA256 d9ccf2ff3c55825cbca703f2280bb43b20d630b536a777b0a0dcc58f6499ae4e
MD5 ddd507cac8da6e197f01477f5f548016
SHA1 4393b3ae022ee2c6128e70bc57e84f9a19ad81ed
SHA512 853a2b037f92967c8fdb7f65da05cf2dcd90bbd857c18d455371130115ba0ce389d4f6194e0f46f2eaa57de9e04dcdf8ac681e9264d4634f063516ede5b8fc5e
SSDEEP 3072:doM+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gr:doM+hFD+7t56OD9ZfSApprr
TLSH
T17FD31232AA91D8BBC9FC6541B157A304DE66ACED41DE3A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3628413f-8803-45e7-afe5-398af58d02ea.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3628413f-8803-45e7-afe5-398af58d02ea.tmp
Size 267KB
SHA256 1ff9345eccc25d22ab95fd7e4423d6d42732eaa1042a2846344651ba68f49b03
MD5 b36712f13487b48b9554744627fe781c
SHA1 7a6ebcbb602e56d453355d4bfa8f20bbea1cc1ab
SHA512 64b9a105f0cdbb1a8c3150e4c0dcfb8ce4d1471e9e4056372b89947530da8c321d478c0843577e66158a35df6eadbc8139795bca7376b05696d6cc0a5a5a6032
SSDEEP 6144:jfEzFNMXd2rVuI6ohQVEWxIbrwI+hFD+7t56OD9ZfSApprm:jfEzMouIdQu/bvyFSXD9ZfS4k
TLSH
T157441221FA49DD6F85781202600F0B10DF625CD5C2AE962D484A5F9FB26FE4D0AB7F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f97dd89-bbae-4fcb-ac4a-844c509db1e3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4f97dd89-bbae-4fcb-ac4a-844c509db1e3.tmp
Size 268KB
SHA256 b74d44e65767f63e1b28561c053adfe2d29892c9c2c26515c7f8c33bc5c0365f
MD5 a5bbbd1ba619b96ece80b2bb07bebab5
SHA1 34f235cd75fc5095dff9fccdf777a35ec47c7736
SHA512 928d1f5817233f323d1fee34f377a09e7a4d46a14b34de4aa71da61a6a3b41043910666269aff51d4e7ac17291623152b5128b26e7b29fcf183939c7432aa4f1
SSDEEP 6144:QOhwzFNMXd2rVuI6ohQVEWxIbrwI+hFD+7t56OD9ZfSApprm:QOqzMouIdQu/bvyFSXD9ZfS4k
TLSH
T1AE441231F645DD6B84781202A00F0B10DE72ADD6C2AE961D484A5F5BB26FE4C1BB7F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b03038f-d4c8-4398-90e7-70d5f1ff450e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8b03038f-d4c8-4398-90e7-70d5f1ff450e.tmp
Size 268KB
SHA256 e83fa9e53657fb8fa3538fe87eba20d4cb2f74a4031d58cccf36547e37264448
MD5 c850bc7ec0c28714b3e33954073c4387
SHA1 babad2efc2bb46cade7f262f377dbc452c1d4214
SHA512 2cd56180bf7f2cde46ce24b6852c2453fa29d265731d11b037d2739d6260153ca363fbed35c2b1d791fb0141f0e532747667ae29c64bc07e8a44d8a303b0c22f
SSDEEP 6144:gOhwzFNMXd2rVuI6ohQVEWxIbrwI+hFD+7t56OD9ZfSApprm:gOqzMouIdQu/bvyFSXD9ZfS4k
TLSH
T157441231F645DD6B84781202A00F0B10DE72ADD6C2AE961D484A5F5BB26FE4C1BB7F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98e41f5e-f65f-4581-9f28-2ca2f90e04b1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\98e41f5e-f65f-4581-9f28-2ca2f90e04b1.tmp
Size 268KB
SHA256 4e91ed5984c6811969bfdea241ddd6e5b721f3c0ff22c70b6e1455479df3a832
MD5 65eee6c3d047c3ab829a827418c6fa0b
SHA1 9a11c39d16b0b3ce225fa2f9050b87dda54bdaa7
SHA512 12f18f8cbadd82dd380f025ce87331170dc8a595b2bb5f7a69787c5c3e3e7546a111e30d03fcfaf408bb16426dd17fac5f77aee8342fc4ff622f55ad10f1e985
SSDEEP 6144:g84gzFNMXd2rVuI6ohQVEWxIbrwI+hFD+7t56OD9ZfSApprm:g8HzMouIdQu/bvyFSXD9ZfS4k
TLSH
T1B7441230F649DD6B84781202600F0B10DE729DD6C2AE961D484A5F5BB26FD4C1BB7F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a6249f26f37b42a8aab1c42bcd8d2d1ed0465e9642dfcd70d03e3935cdfab2ce
MD5 6ac2bdb5618eb33217283a8c2a2bbea7
SHA1 929bbd0ea4faacadcd10729d56f75f85718fe818
SHA512 210db67eaa7e247fa4c61bc2e2b4275f8573062e567be16ef70acddac71222e128e021da8a6e8867a5b5f1507c9fa736ffd85aef609528eb4c496e58ccdf5830
MD5 SHA1 SHA512

Submit Download

03b1bbfe-1619-45cd-8b31-607367b2fb15.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\03b1bbfe-1619-45cd-8b31-607367b2fb15.tmp
Size 13KB
SHA256 f4c11ebd837202d822de7cdd09ed7dcc3981669424ab9a0beace262a7a7dbf05
MD5 a30d316bb10c8c5f0560b69c85bd5948
SHA1 bad4d4db4d8204c912d7cfb60872b5163e6f43d6
SHA512 10848322411fbde652e6222dd08bac262f20c609b0b6d95d544ea7dd71164f12a60d0d1de7695196316b1e93fbde3464251c6fe1672db366a72514f246c947fb
SSDEEP 192:bR/lQRvv71vrPRpnsuB9IHsb+WNnOz+yDEWVLGckwpqIVyIsnAUgE:bR/lQn5LXN2wgzEWhGcDE
TLSH
T1D352A52AA9103A3B9CDBD21AF965BB5BD7F5102235952E84E6FC893C14EB5CC3227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06deed9a-45e4-48be-bcfc-8152980c13c6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\06deed9a-45e4-48be-bcfc-8152980c13c6.tmp
Size 12KB
SHA256 cf8b9509146c48479c8607d25459e8e537418e761fbd46b267c3518f3acae97c
MD5 93c80c30eca095fa54f41d509af2d698
SHA1 7378c3d9228b32c5c2f78b59a6e5ad366f7c893e
SHA512 968e08a8540b3bb35adeba18301f241ebd0000afc69ec5564e7e0949c6f300c860eef4f58eb6c9005d0913b3efc0cdbcadc3dab08b6953131050e3e15c3d3e77
SSDEEP 192:bRSlDRvv71vrPRpnsuB9IHsb+WNnOz+yDEWVLGckwpqIVyIsnAUgE:bRSlNn5LXN2wgzEWhGcDE
TLSH
T1B052B62AAD103A3B9CDBD21AF965BB5BD7F5102235952E84E6FC893C14EB5CC3227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d0b8d00-b0ef-4e2c-9b3e-31f59c2ac3f9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0d0b8d00-b0ef-4e2c-9b3e-31f59c2ac3f9.tmp
Size 12KB
SHA256 ffc045b0b0cf267e807427bd164152f2c0dafbaf89d28cbe518ea85d6a40902b
MD5 15d9878597288c0efb7eb34ad693ea86
SHA1 9f64d965ae536fb3be17af0b5432682a8ba4edcc
SHA512 181eb31e8617e39c690352f5627ede136c88ca47e46e71d60ad05e88a9ac4c50376b149cd5dde14f31f300fcf84c1b692f7a3da3f71e237893fa7c275679408b
SSDEEP 192:bR/0D42v71vAPRp2Z9IHsb+WNnxW0K6LGckwpq2VyIsnAUgE:bR/0MC56X62wE0KQGc/E
TLSH
T16142A52DE910793B5CDBD22AF961BB57D7F5102221852E84E6FC893C15EB5CC3227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33bb8160-ed92-4301-a9da-b628e63dc702.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\33bb8160-ed92-4301-a9da-b628e63dc702.tmp
Size 12KB
SHA256 ca0d05523a4063663714b4cbe2de2026fb8b5059559e9cc8809d7235ead432af
MD5 20f27d1c39ccb042d64990afa44a30e0
SHA1 492431b45786e08c7f5e408e4676c1212bee6040
SHA512 836b63282ec427f2f0f0fd4c28073415847bf1932f0a3b8ee6b60e2fd642ab83c36004dd7a1089632fc4a977fc10e9e33663e32f32d5ea9be077e41a8c8793c5
SSDEEP 192:bR/0DR2v71vrPRpnsuB9IHsb+WNnOz+zUeMVLGckwpqIVyIsnAUgE:bR/0NC5LXN2wg3eMhGcDE
TLSH
T16D52B62AA9103A3B9CDBD21AF965BB57D7F5202235942E84E6FC8D3C14EB5CC3127407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c32bbad-ee39-4730-9a56-514c272baa90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3c32bbad-ee39-4730-9a56-514c272baa90.tmp
Size 11KB
SHA256 a1eca11e84a410999c6e39725170bcca11e08312e35c97aedef732a2ce085c0c
MD5 0b8a836a43453bc9800f1c0d424fa5f2
SHA1 402b5035316b9818f501b6536f89b3ad46bfc9ac
SHA512 b4b9ea2b1845aaf0082327b52062109fb9e1d98bfcf47c16350be4a506fe0bf0d7ea58abff5b3110a41a9da24534285e40ecf8ae7bb22a6f40f9e05954a5c495
SSDEEP 192:bR/0Dl2v71vAPRp2Z9IHsb+WNnxW0nLGckwpqmVyIsnAUge:bR/0JC56X62wE0LGcve
TLSH
T19F42A42EED10753B5CDBD22AF961BB57D7F5102221952E84EAF8893C14EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dca7d2e-edc8-47e9-89ea-c9732c16ba96.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4dca7d2e-edc8-47e9-89ea-c9732c16ba96.tmp
Size 12KB
SHA256 45df1e6d1423a12a98fe6400b8710e721c7b34d402a8a6a64503b74c05535950
MD5 ffbb9f42612350feacbdefe04f01464a
SHA1 a5b63be357f58154550fdb74d883aae135644971
SHA512 dd4e64322a4e108b45632ab81caaf229c1a1b01bfd6f449f1337e6e851788c75f1fdff04b5a46244c7985521cb2679f1519f761c7527e2756e83d9b1224d3252
SSDEEP 192:bR/YDRvv71vrPRpnsuB9IHsb+WNnOz+I2YZVLGckwpqIVyIsnAUgE:bR/YNn5LXN2wgkYZhGcDE
TLSH
T14D52A72AAD10393B9CDBD21AF965BB57D7F5102275942E84E6FC893C14EB5CC3127407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7da46574-0809-46ee-bade-aa555204f1c8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7da46574-0809-46ee-bade-aa555204f1c8.tmp
Size 12KB
SHA256 98e6d70a6fb3d63a5ad1f1eaf280ff221e178f10db4b181370adc12d4c4acac2
MD5 33a07289bffe160c08233eabb7ff258a
SHA1 2c8c3b7cf6e4617873475f031930284409098802
SHA512 4acab7bbf54807d2be67b2e0bcc92e4754196f71c3e01680f9d35f77eeda9edc539f9607f5c0d3f2589fd2e2c4c6b35befb5b9b44d2096e71f9c351f297b4d1f
SSDEEP 192:bR/0DR2v71vAPRp2ZB9IHsb+WNnOz+FK226LGckwpq2VyIsnAUgE:bR/0NC56Xi2wgv22QGc/E
TLSH
T1A442B52AAD103A3B9CDBD21AF961BB57D7F5102265952E84E6FC8D3C14EB5CC3227807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80b3c4b3-7d2c-46eb-b7fd-f0ab7edcfc39.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\80b3c4b3-7d2c-46eb-b7fd-f0ab7edcfc39.tmp
Size 414B
SHA256 87cee61a80beb063b0b62fead3b50ff854c81836050ddcdb6c16389103584e07
MD5 84f42bc8915e0029f046c364f3b80b45
SHA1 40646e28ff4291497430cdcc250942820440f296
SHA512 78ff23b7ca82a9edc1edcca6fe7dbc3e8125f9c0b0788fea0386b840e238bf681125af894cda99fc3cbec2cf3fde1ed017ed3ef9da6469d4b97208c5eee9258b
TLSH
T10BE02BA9CD35EC3719FC0B1850518746EAC013172790454F373C810D8FB567A4596D1C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 624B
SHA256 e9e80b0ac68c731e11e944791d7f63de943fb1271de47dc374c1b70631fb0e28
MD5 f6ddb7a47adc09ba798ccc410d9afc74
SHA1 70469198443454654f50c3d26acb2dca592a735e
SHA512 144a4dc03792ead1614d5fed2cd8e47e826b5072ff9e4527217ef4de2e9f64f7f1633341211e0d758792575d5a96e7482d9f1851c935ca77a8d716e51d9e7d72
TLSH
T10DF0278832E0C080DF502DB887BE4D286030A7CBF4758B43DA40727BC4032D1D654554
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 672B
SHA256 ce346939b566d4c867eb5be78d7366e5c6f6def84216ddf61a2b7c08fd68d91d
MD5 d3223c7629be1546c44894346fb319ff
SHA1 2e8f1d92b47b33aee82500f6c0784a87da8da8de
SHA512 12ae1fdd2fab0af96f60b28a17bcb4c96ec1f89afc427f965a8f023ab87a854cbaa0ffdf00f70365c1bf270c9319e5cd5d095971549e722306c31cc0ce8c544c
TLSH
T1FB01E95466E0D080EF602DB987FE4D256430A7C7F57AC743DA447177C8033A2D655591
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f57dccd-c4d7-4874-bdb3-3ce35ba8f0ce.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0f57dccd-c4d7-4874-bdb3-3ce35ba8f0ce.tmp
Size 3KB
SHA256 be76d9cbc29218843a4809eaa87aaa302899365124338662c408918339e58427
MD5 fd7fb78b79dfbc474c4f1be430edfb97
SHA1 504c54cf3e8d4c313bf0b31f57aad04e7977dded
SHA512 957b6a41ed4e0de2c9a1e23164b28b0b1ccb8abede0f6b13bde8d59d2f095da353679856e08472878f5b5ea9bf0d6e6c3122c3afb2da148c36b05d4b87f37da4
TLSH
T1B5817FF7C3E8C66DC91252F59A147E2FCE2D0914122C3C26C8E4EE5B97E2472E20174E
MD5 SHA1 SHA512 TLSH

Submit Download

4260ff80-965d-4615-88fa-36fa2d534680.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4260ff80-965d-4615-88fa-36fa2d534680.tmp
Size 4KB
SHA256 208e52cecf5a3e0214c9e146c57e71de716359a72601031a106cf32f83482d67
MD5 cfc3b27149799c69bf72e109f018edee
SHA1 18048658a0d880412cf41bc76bd14f77819c9e6f
SHA512 ce4d8d817a3396bcd47662bde87dd1a89bfcc756906cfffbd0d05e748ab3512adc3662d5387450de411428b125bfda1dccba9425f838ba42c10b4a93f9138bf4
SSDEEP 96:Di9ij7uG3ZmIbWixnmHMq3qqzVdQbmtQHjhq:Di9ij7uG3ZmIbWixnmHMq3qqzV+bmtQY
TLSH
T18DA190F7C3E8867DC91256F49B157E2FCE2D0914532C3C6688E4AE5B97E2872E20174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c332e0fa-3490-41ab-a0ed-da6fed11bcaf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c332e0fa-3490-41ab-a0ed-da6fed11bcaf.tmp
Size 1KB
SHA256 64c2ad6cb8603a3d8e9d2112247d377e33227b52e459f050a67f717a3fb2ba19
MD5 396e69dfa082a39df4a66e215332deaa
SHA1 e0e997f1bf3fd2710881b3b9bd5080e8e8f6376c
SHA512 b51b0229f5a73603c3ba657957e3bb41797da45ffe6dbc259f8fc58b79569ce66649c2b4c0873cf218ceab75e65a18574f96552436ceee87bc52d9e2a535db82
TLSH
T1E831CC93D9BEB86B106E49A71D44BD0A1E7AA431414394F8EB9B936CB1A24F70F12032
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 4205c0c7591f745fd68f5cd8c7454f93967105a530b5b3fe79574e31f356d799
MD5 d286423a4191d4492455a485e63ad6cf
SHA1 8c268c60014db4ffade18df9551525a8d0e1ed3b
SHA512 953e9c2394c4c9504b2568db7aa0d622fbd75451cae1f763873cfdbfb4afd42fc4289e5793df4111da8abd6b5112042ec9c41fe5c05c1e629bd352f425abaead
TLSH
T114A0022081C50555ED2092B46467055132D24C19F572575355992495DE6F1C48161504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 6704f0f958888eeab06669f6ab5ff0036b7248f16e10c32a0f822c172374af7f
MD5 93fdbbbf23624e06741dba145ece20b4
SHA1 2f8f536044c46da892eec9e3d98bff8ae2297339
SHA512 80b48a39371aeb8305444770b47189bb37c75b200ee5c941f52523bcb70db0b46870765ca55989be0fbe8f22d48a3cabda6f2ee7cf7657a96789c761d947034b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

a62d42e9-1859-4b46-a839-5c6237611c01.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a62d42e9-1859-4b46-a839-5c6237611c01.tmp
Size 11KB
SHA256 5b047331ce8a978a628aaaa8763a141190c93edf9f4a077df360c67e059ef7ce
MD5 9a8cff21470546faca0049818978bc5a
SHA1 6b127801e3577f2f15f1e045e079e46176df3a94
SHA512 43635159c21547f0dec1e2db4608930d50c3032ec415ad1f4f48a3ccbe8e195248ebc684ca9a8909f2000fc2358c657fd895ca6d96b34aefbf114f1803c08bc2
SSDEEP 192:bR/0DJ2v71vAPRp2Z9IHsb+WNnxW0nLGckwpqmVyIsnAUge:bR/0FC56X62wE0LGcve
TLSH
T1DE42A42EAD10793B5CDBD22AF961BB57D7F5102231952E84EAFC893C24EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcf2e566-ea72-4aed-87df-97a714bf4f63.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fcf2e566-ea72-4aed-87df-97a714bf4f63.tmp
Size 13KB
SHA256 a2ea6fad1985e89238a5ba1cd98589be2256adca52eacb0ead56806cfeed00d0
MD5 e53e4be91eb409f0ed5da9961aeb0822
SHA1 18d5908723370674ce57c57770b219d54a1c99ad
SHA512 c2126c0a30d384d05094fe5442b19395fef08edab56d0d0dc6391b3cb554c161f750d764293fcf890c6f4cf8c696c2a403a4ee6571995bc1175a7bfe715f80fc
SSDEEP 384:c6jY/7KxkXqKf/pUZNCgVLH2HfgslcLXODYj+ErU3AFHGoVt7ShGO:cqY/7KxkXqKf/pUZNCgVLH2HfgsqTOEi
TLSH
T1C4520967684C9A3F0FD8CA4DDC16AF4FADF502576668092453FB9C18039A7CA114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af823e37-6840-471f-a295-4982f800e8c1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\af823e37-6840-471f-a295-4982f800e8c1.tmp
Size 267KB
SHA256 d252899eaba861119886ac6650214ae9bc404202864f699b528154f94f1ed403
MD5 37e0a3231aec713627eaec27181d057d
SHA1 8bf2831688d5e5b5d8ad29141c1a2f49df28ccfa
SHA512 ce7082dda2d47e840a0a44e8a496a48d32f7062d466c461dd867e49719a85b5341984126b9172374356334e08d8a70b61a24a1fc5ad9e647018b07c8aa7a9ba3
SSDEEP 6144:QfEzFNMXd2rVuI6ohQVEWxIbrwI+hFD+7t56OD9ZfSApprm:QfEzMouIdQu/bvyFSXD9ZfS4k
TLSH
T11B441221FA49DD6BC4781202600F0B10DF625CD5C2AE962D484A5F9FB26FE4D0AB7F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 473c804c4a55742ec0782df6d94f024f482b39e655ca8826e4c5594c2787a4ad
MD5 8f84ac1290dacb52a0a322014ae136e6
SHA1 4504304f7e324a0bd666eea2b317d3183d0d42f1
SHA512 c9b41838dd39277eeed07f81fd5ba64ad987ac76e3f30553da1666ab9b5be001f0d02cc309cecbbb3dcac8749ef4faf05cacc86e5392d80fb381d65978648b13
SSDEEP 96:iq3NYqGeHo9xrLSwtznEeqKix4q3qeYrhGaq66L0m0RIzoZcBPtiNLhDAyRLcxZn:iqdYqGAjwtznEeqKix4q3qtZq64cIzoq
TLSH
T1DFA1F0313275F1D5CC663F031A2D19D0A3AF4396EA949F48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09ab744c-ee3c-4b52-b969-26bcab4d984a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\09ab744c-ee3c-4b52-b969-26bcab4d984a.tmp
Size 20KB
SHA256 bc228c41f936c1db5645cba768cc9610d13ea12f6881fc55bd0ceef9de69a0f9
MD5 d552c87afff69fe5a47217fc96c0c607
SHA1 c85aa088297a5453b03aeecaf58c6328412aa3a3
SHA512 935733bc547ea9e39043e5747e1a2e5b57c49210e818398eed0f1ddc4d0bdd9abd3aecfbaed4b87a2e36098f0f59be50766633aed9ce19886196c31ebd91fb7c
SSDEEP 384:+iFLrvFwPasubhwsNV8TUNTUlIl0/51yaizIGmeh+bQnCNwi2a87wh:VFnGUwgq1kVhQvSi2v8h
TLSH
T12AA27D738C68E937ADA36A40F84F36139E7582A7DAC56BA4D3CD9A0D01CB2CC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

219b160f-db16-4ac1-a00a-07bf01c2499b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\219b160f-db16-4ac1-a00a-07bf01c2499b.tmp
Size 25KB
SHA256 309913919600f6625270b7a16932c26cf6f3abfc4419983cc541aafc9e0a6845
MD5 af2fb8155e75c8b04a5fad74acecff39
SHA1 e0162acf4ddea13e0118b80ef17db2fe92d7ecea
SHA512 3b08d8df6e6a9059763a9c0a5ee1b65f38b4a29b3a135496a6451db3b31c719f5c8c0776fb301695a6a3655cfccbe6259216fccc0a4b5cce70cf77354e083ab3
SSDEEP 384:+iFLJvFwPasubXsN+8TUNTUlIR0/u1n9aizIGmeh+bQnRTitgTvFA8Bnrdo7MKwV:VFFv1wgjCkVhQYits68soKwIr+vKv8h
TLSH
T192C24BB2CCA49DF758A2E9C0E84AF5176EA44277C5896A5C92FCBA3D308F1F80303D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29d0f0a6-06ca-4931-bfbc-84eb78c00272.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\29d0f0a6-06ca-4931-bfbc-84eb78c00272.tmp
Size 8KB
SHA256 8bb94bbcb44df62a8ed3df7cdeea88c386b33136e07f9372644448c0f9c6adbf
MD5 7138b1da5d3e45dc1b81ef2cfa4084e3
SHA1 4e658921b5bb7aa71ccc57b545fbe93c0fd43bf5
SHA512 57702e8ade2e2a909bffed4305a915bbe86dc9ba74605826abf0c460dbad0ccc9ab41d30d8aa3905859f4bd8dfc4d8028da45e1c94c30ddef3995f9034468a16
SSDEEP 192:AONO6IEIQmiUyGlT+uIGmeh+bQnm27H3qtU6:AONO6Doj+uIGmeh+bQnvH2U6
TLSH
T16C121936A878BC779ED3A840F48739235EA58227EB897F94D5DC1A1C01EF25C130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42e2d23a-75d7-4878-be74-ba9aab6abd58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\42e2d23a-75d7-4878-be74-ba9aab6abd58.tmp
Size 18KB
SHA256 5ec3e9caeec6513a33e69d6d287773785809a707573d9a85b8ef6694a51c351d
MD5 43712fcb844efa890510901a38793cb4
SHA1 cd4c4f2a9ef58efc8683905b5e38b179f707adc1
SHA512 ae4a524820fd5a6c62fe5b1e4b2d1b2fdf52a9f6409462b75a64edbb6db495c013582e51464f8eb88f5d0fd9e65c4b75f2138fa91ed56917a0fdb5f10b4c6df5
SSDEEP 384:LrvFwPasuHwsNLR/51yaizIGmeh+bQnpci2a87wh:nsK1kVhQzi2v8h
TLSH
T180827C769C38BD325D93A540F84B3A176E758267AAC52BA496DDAB0D01CF3CC1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e84e7ac-d81d-4ad5-8ba1-aa0c1cc5c43f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e84e7ac-d81d-4ad5-8ba1-aa0c1cc5c43f.tmp
Size 8KB
SHA256 d9f6ea06e25e5835d540be713fdcc221b278fe8ad362a76a4a2ecc0145d9def5
MD5 3d8bfa3dda41aa8d914064d705c3c66c
SHA1 b75d70da4b7eabc34047bd62235b85b999d0c88b
SHA512 85735eeb7d6a23f92eba06e261be8277ccadcc0dc05aaea778db8d6995d340749a8499eaa7a8e2793fbe20bef0761215badc49a92f0f677988a727b3b7db80e2
SSDEEP 96:3qONkMQsjpfe/tyng7X5ih/cIPURHl8h4otop5bsYDlNBnP9ZvEI0IG2jb90ymt+:aONg6IE7QmiUyplTPuIGmeh+IC7sJAU6
TLSH
T10D020935AC78BC7B9EF3AE04F4877A239EA5112BA5852F84D9E81F1D00D725C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f717a298dff62acb0b7ec152c22cca57b3c6aba901910485410eb8d92ec3f86
MD5 48eb4856ef908e5dcf61e3b389953eb2
SHA1 a4008875d23a2054012185fc5d479b3f65a947a4
SHA512 31bd1bf3a2facb7554dd9a6218e64c938b031b6fe790c81d54651407f57c2012b91944f82b862bbe9068a75ec9584e4a633b56a98461a41dd014705599d95529
TLSH
T190D0C0F463E2D003F530B272143453C1334C8884325083A08033000D0F4C0E60113EC8
MD5 SHA1 SHA512 TLSH

Submit Download

2d2a2ea0-0152-49da-9934-cb22e2f89ea7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d2a2ea0-0152-49da-9934-cb22e2f89ea7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f954438-ba10-4e40-b540-a1636ea7dac5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2f954438-ba10-4e40-b540-a1636ea7dac5.tmp
Size 10KB
SHA256 84c768c08c03ab226a49686370bfe575d5364c9e4d60036b49019907b272ffe9
MD5 d4f5a161991558ba9c281b4fe81a4e9c
SHA1 1080859f250f60ef26ffd1f19eaf9a2dfc0a1256
SHA512 476c98c048a1cf5f10c348257fb89d8d9f140355e59a2f08e8a1f1f64631e030ecc9dfe369d8bd9ca802443376cc42d830e8a27d6faebd00f67c27c3b3a6952e
SSDEEP 192:sxZHRBnk/fxsyhcIdpLHW6+WNGYap38JrYIg53J:sxZHjk/fxsyvLHbGmSf
TLSH
T16C22D956AE38663B8CC7E21DBB657F13E6F9503261911E48A6FC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31d36493-8839-43dd-bb3b-de8528bddaac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\31d36493-8839-43dd-bb3b-de8528bddaac.tmp
Size 11KB
SHA256 bf287827ef25bd82b0fcd1e1982b66fd744a47079be50fc8a25b111707d7847f
MD5 f8ed5789ea83820bd0787015364ac2e7
SHA1 5dfb38d31d9abac34de101402f238823bd8956ec
SHA512 7713ae0228954ef6f8239ad0b6a930aafa89511a9aaf08eee106e64e9633e0ce8c444c6eaa7066a1d35f57660df9368a880cb2128463313a66e97c1a553c8509
SSDEEP 192:sxZHRenk/fxspWpVJhcIdpLHW6+WNGYapd8J6qIgb3J:sxZH6k/fxspWvJvLHbGAhN
TLSH
T15732D9566E28A93B8CC7D21DFB657F13D6F9503261911E48A6FC8A1C05F76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39ea67b3-ea71-4f47-a647-0095cb4e209f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39ea67b3-ea71-4f47-a647-0095cb4e209f.tmp
Size 27KB
SHA256 635138a991c3784b41b5823625a3088ee9b609951dbc41c057c6c18d02303262
MD5 ac4b2ed623be84ab897946d96d5abd2a
SHA1 1bbd25c81495da6e0acb835d8f2a8ab89a516c6f
SHA512 1a8f5b326a2dc79bc64a5bf72ef7e3f49a23994b732447afd41023a60df753d981f9fbfdb501d87e5b0e7f7f11ecd2e665fafc3a4c8f594e2f0caf9caba97643
SSDEEP 768:CyWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7pro4/feHmRI:CyWPcLKWvKeEeu1jaClLiF7C4/WHmRI
TLSH
T155C2EB3B640CCB7E5FC01E9DDD5A6FA76E9802C79A644D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 662eb8baae9eef02fab80ec2e2e30e10a46ca58026b93444da8405016c83ea33
MD5 d296e6f7014948f4c4aa7285d4e40829
SHA1 5c4738562d2fa1c4ec408e876f18795d4ebc12e1
SHA512 d9e4da56003d6b201b5ce9312fbcdd93f64a1e5fc72a0870a7f10f8cbf178a10d67b18c3e2ae77bbc496058897961e7e7a4c3b821b75a0e94d71f41753bfbc29
TLSH
T1EAE026B84AC8C22EE6086497017C739D9FAC265A96D0691E3B00C684B645C4CE7936D0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 fa8fc8cdf5587bbd17e7d85aed9a27eae20699ca69221dd1b2725a5cb56cb3b9
MD5 86e4f401eed9122f9276c1bceddc18de
SHA1 2f802375af39979d868b382964b392803e7f04bd
SHA512 ee800e98051d7844e191b3a5c84975be68a2a2b9a048aeb87f9bf54511a5a1333073da46522de3aa6c178411ab03e11186291b8483140d7cbd60cec297549b70
TLSH
T18251B68BD768C2AAFB68417441F6D3873330EAA1EDDB1F1A25ECC5BD9F0A7549108314
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 2968a591270f5d2141e872730fa85d288576bec0fc0f1daad5229c366e51cdce
MD5 17b27f81b837e65e69b75eb5a3219806
SHA1 09637acc7a5a2b55ada29f70f892173a59c07306
SHA512 eee8075df86cf7e6078883ddb45282eadc97056ebcf05f11dc1ae20540dd22f3660d70e8143897d55b24e0d0e081c20b43437a11494454dd1ecedd87e6279142
SSDEEP 3:MsEllllkEthXllkl2zEFell/:/M/xT02z+e//
TLSH
T1294402047B800455C50020314019935003B0E8144575BB47749994225C895885C10100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efcb5bb0-ec77-4d72-bebb-a24bda5dd1ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\efcb5bb0-ec77-4d72-bebb-a24bda5dd1ba.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

03cb7fdf-7a6a-465d-ab7e-1e2d5f531e1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\03cb7fdf-7a6a-465d-ab7e-1e2d5f531e1d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

4ace80cb-8958-42be-b6da-3e7aae823390.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4ace80cb-8958-42be-b6da-3e7aae823390.tmp
Size 1KB
SHA256 7fec492959683a8d4142f3807189ae036ea2dd601d5f51fd4101e1ca3497921c
MD5 97bd269e8c49fd90f264e4bb92a64bee
SHA1 c1127936e6123c7fed03b3812e6b5a7d833594ce
SHA512 1650716cd01d9e5e54872b56854e685b74f2f49545f9705c8659db7cac3b1e4105ac6d1b780d1e0f07d53d72a642a3ea443fb6d66dc9005771a6a840d4e4f4bb
TLSH
T1BF217CF3C3E5866EC90156F0AA246E2BCF2D0515421C3C1A99E4EF2BD7E3475E10194F
MD5 SHA1 SHA512 TLSH

Submit Download

fc070999-eb44-43a8-85be-9c2e83953f64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fc070999-eb44-43a8-85be-9c2e83953f64.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d550b6a390df9ade68b361e8d8e3c1c8ed66501875627aefe017f489d508a50b
MD5 fd54f2a00517437eee29d60955807211
SHA1 cf8c49fcdd99172ba7410a0db33aac174a930aad
SHA512 c63392e941e1917042ee0b52be1caf24d2a359b20d85e527b1ab4570bc9b8121025219b2f9cd9076c78fefdb127903efcf59d5111d3037b77b0f2d125de4f478
SSDEEP 96:KsuwKTqO2RyKa8U6L2qkYsk8Y1PWSkKOBWMkCKqVkK5OtWK+sD:2DZPNJK
TLSH
T114B14001377A4205387D290C46A4D76F92563072305AFA2F7FF999B9CE2AE150DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aeff83d4-46f5-4d81-beca-9e63fd70912d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aeff83d4-46f5-4d81-beca-9e63fd70912d.tmp
Size 9KB
SHA256 0971534300e104299368b596bb584aedd94c82e52773ddbb8aab889ff8d8faab
MD5 f374277f817709571b33eadd0c461180
SHA1 a6fcd488c8b898fdb9b5a946901a57b600c5f50d
SHA512 c6b922a548d45aa8c1ca9a1dfe3dc3a7dd3f4c55fc5f048a4a1f8a8c718eff2ca74b31777cac70bd3dd174a0d2977ce7614f3cc143ed4c74398705f45d962b70
SSDEEP 192:sxZHRBnk/fxsRhcIdpJHW6+WNGYapJ8S5YIgrJ:sxZHjk/fxsRvJHbG0l9
TLSH
T15722A6526E38A53B8CC7E21DBB65BF53E6F95032A5D11E48EAFC861C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca1293e4-2943-4b13-95f6-3056d35111bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca1293e4-2943-4b13-95f6-3056d35111bd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d206cce7-425d-44b8-8278-f7d6bac1b64e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d206cce7-425d-44b8-8278-f7d6bac1b64e.tmp
Size 9KB
SHA256 434c1ee8ce4ea65908a37003dec40a404af24e82d116ad9212f1021d2b93ee94
MD5 eb19dbe31bfa694980fe6d5b9f416b4e
SHA1 3b47fe8148b1325101d4011dfb852ddb58279649
SHA512 e1a5ae0df73d496545a26dbe8be35194ffe1459f9ff596ce110420ec428140e9ee35f68f240aa1642450a3947331e8377a904b9eda8455170639f3ef9c270fa8
SSDEEP 192:sxZHRBnk/fxs2hcIdpJHW6+WNGYapJ8S5YIg5dJ:sxZHjk/fxs2vJHbG0lJ
TLSH
T10B22B756AE38A63B8CC7D21DBB65BF53E6F9503261D11E48EAFC861C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee959748-8c4b-4d3a-bb4e-ca99646da7a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee959748-8c4b-4d3a-bb4e-ca99646da7a8.tmp
Size 10KB
SHA256 9822796671968b90c7ba116c08616bb5782840c6e5ce480d5707d0e6d9f67d31
MD5 33ce61cea4ccca122aaf3bdc0ef27208
SHA1 bd10c3e78121f2bdf70114b70065702ce43a0cad
SHA512 29eac30fb13b4063401753ababea65fd1865ecf69271ddfe0c0a823168c61d60d58d814fc30c632289dd5a7b05799eeb927ebaa436e2948d4c2dca7d1ad7cfcc
SSDEEP 192:sxZHRBnk/fxsyhcIdpJHW6+WNGYap58G5YIg53J:sxZHjk/fxsyvJHbG0Zf
TLSH
T14922C756AE38A63B8CC7E21DBB657F13E6F9503261911E48E6FC861C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 1108a4b5ec17892d53aa97d873f59322c4526197e7866d0f1e999fd0724201c2
MD5 bc04734506030c0340df103cd2b2662a
SHA1 5bb069c2526d1487a5f76c29aea18fc51ff9eaef
SHA512 fbdec768df9f5670fc001e330a4cb8da9cf4a76b3f1fc6a70714fa7c59848ace285d58a71a12fbb876852a282f97d0974db3cd5a1862ef48917c5b4778298739
TLSH
T1B52145C0A39794456E8AA741C21DA507A0B92E75210F5C76272ECEF8CF4C8150F2FE65
MD5 SHA1 SHA512 TLSH

Submit Download

1bd9b16a-d0a9-49a1-b7f3-e953dd9d0cac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1bd9b16a-d0a9-49a1-b7f3-e953dd9d0cac.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ce2e5a35-e28a-450d-a8d4-99cf22575d4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ce2e5a35-e28a-450d-a8d4-99cf22575d4d.tmp
Size 18KB
SHA256 fc0e0daacb4a86cbc693ca49234c0c7587453f2b712e76e50f78de2edbbe45b8
MD5 63795c9f0fee464190e6e6c45ea8ac6b
SHA1 6b30ce4f4eba2c1d0139eb49ceedc0b95afc1497
SHA512 4b28961fc30fa4ea5ac2bacd01b434cce5630a77a7d0b193a58db6128f17ca2e8cf80f9270b86d9411eb131380090e9df278bea3860ab1be24d114677a72710e
SSDEEP 384:HrvFwPasuHwsNL0/51yaizIGmeh+bQnpci2a87wh:Lsv1kVhQzi2v8h
TLSH
T169826C769C38AD325D93A540F84B3A176E75826BAAC52B9496DDAB0D01CF3CC1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6599d1e-791d-4f61-8cac-d864b5416158.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c6599d1e-791d-4f61-8cac-d864b5416158.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b59cff9d5b10da888b6bed24933237a2b773baef8f30799bf47ac0be770fb29f
MD5 aa1452b892558b7b99f25aa3bd58a5d2
SHA1 a6faa528b43f907dd8af315e7abe47ddf526684d
SHA512 2f15ea7274039d4636bb305f04a3244d95c9ef6ec6ddd72226c784498a3b93b21b6095c9cff9edacac36bad4a353e96aeac8e37e4434b58f53de6e9265910008
TLSH
T11C41245DA6EE214CB3B76F4A9BF6A86E447EBD372F0A954D00110E4F0672A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 dab3f56c02dffd1766d651b9ff7bf7235e260511d0716ba2fd689f23b64a924e
MD5 1210aad5b9c9f6aae874d2875ac943c9
SHA1 f7f85cc8120383694175ee506298c7698833a1cb
SHA512 937eaaf892e993139ae2d4c3d1651331a605fd945dfc0194fb69ca8da3113303d5d4b6383585333a0ff36b3deb98637f9e211d1e4938714e86f330348a844345
SSDEEP 1536:fY0+z30CPtAHkWC9OdBTNKe2flJnfYoUV3CNBQkj2yJqduKzqRWmHQ4N6MKv9aV4:fY0+z30CPtAHkWsOdBTNKe2flJnfYoUT
TLSH
T128335092E9204D75E1A66F3EF15662227D303D4690F8113212DC25DFAA83D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 3KB
SHA256 1c259716f20a602ed72293f0093e0d01f46ee915bb85ef9e561baccf4a1d3252
MD5 c39b9de10cca0bf3690becbacc6c73e8
SHA1 ee31212c2784af91de0c6b7fa95a26c8f665c0df
SHA512 4f883189b671e92b9a73ba4711631628f329312a8a6703ad8e3236c3685294f85b883d79bf4316dbbf46697dd10a99a0273ec607cc124446bafeb5b81aa8bd45
TLSH
T161611E17B3C84DD3DA8D5735C09C8C2620D682874866BECEEF8F85F0A26F1B5B670164
MD5 SHA1 SHA512 TLSH

Submit Download

javap.exe

Path C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\javap.exe
Size 24KB
SHA256 edc73c5ef6d21a5058e3e4594f6907a7d6c9813ed3ddb55806f708debfcf8488
MD5 a888d6fa6c7e17d80cfe08b61d7e4d4d
SHA1 06a69c302c40c3f012e506feb93dfecf2842224f
SHA512 ed58b24704e4e86740dd464905ff54fd41bb1502fbf9d6faad7c45dfff22139aa68913e22304e4b0b643b06906daf8020989fa9aac947ec7bee227ccbb4defd6
SSDEEP 384:s4zwdbDmyFS25A8NyEIYi2mL4/y8RbIIvZgTY0zT:s4EdDFS25CYiDLk5uIvEzT
TLSH
T1DCB28E27CA800C85FF5B99B0B4E5522BFD75B6A9AED183C72368C0191F503813B997DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\bin\jli.dll
Size 87KB
SHA256 1e189c727f043e924cb8779b673702ba836faa7c9e752e2743b69cde70a2c1fb
MD5 16f5214869501fdb6ed2a788185dcdb5
SHA1 5c4d54a97111a47edc4c80863b4550d9d77d2035
SHA512 4cff432682afca40cbe43562c7780ebd8d8377411a6ae85bde05624a23c8c12b5b9afd79242fe442abb47f3cf095d7f4dbad35d42a4aa633793173a0f2e754f3
SSDEEP 1536:Hamt/822Yaqd9/MoU4XTZA+DyzdQIOPQ9BtG3aSq7lIvd:dt6qdzZu+2zIPQ9BgKSqOvd
TLSH
T16B938E9713E011E1DEB7D578D9B4960BC3F2F0522B61838F136885AA0F636623E1DBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\legal\java.instrument\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\legal\java.instrument\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Programs\Eclipse Adoptium\jdk-21.0.12.101-hotspot\legal\java.instrument\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

67250dcd-017d-45ab-baee-11442232d0ba.tmp

Path C:\Users\Admin\AppData\Local\Temp\67250dcd-017d-45ab-baee-11442232d0ba.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_xdo1wpll.ll3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xdo1wpll.ll3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1688_2138329252\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

ConsoleHost_history.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Size 248B
SHA256 5b8f29dbca6e41f38575d48a3aca0ab14132bc649757423f41163c28b8548550
MD5 f8b1d2f7f9b97ab990f67002b32b8457
SHA1 a259615c15aac546425d5494964afafd6d3ae0d1
SHA512 2479b9920195ba7d760acb51024179cc7a19c2a4f970b604fa331c90bb64ec0556ea00079ce847ee2a6920955068d8555238f6d0df20ba058e0edcdf38fd175b
TLSH
T1F0D0A75716EDE67A006990BBAA7483EF9AD00B9A4F0425A38E005C886621C1D8562847
MD5 SHA1 SHA512 TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 5KB
SHA256 b26273ecf2959d7d3de281d5275331985ea03415104a393219c264bc541ef8f1
MD5 1e17e9875654501f1be6221cd3a4a8dd
SHA1 550d1f9e1eb791d80fbc8c2941826f33dd5bd79c
SHA512 d38cf6ff695e474e021242eebe3ec26fd4abe2d4209606f208966c088387a0630c024ec17a28174427e2dca4c1e3c2f82bc617e86e28a055fb75aec9804ee70a
SSDEEP 96:3n8ZJbC2krTFukvMTZtJnY1QHP2XZtJnY1QHv:X87+X+7Y1A2J7Y1u
TLSH
T1ACB1104057F60219E1B74F7AACB1AB219336BD45DE0B9FCF9240A21D9C30124E93DB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NPOFUMTMRVYAS8N6BFV0.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NPOFUMTMRVYAS8N6BFV0.temp
Size 5KB
SHA256 62f2bd29d712959c9f3c48f437272e167899fc1f7fd7529e039071724346ca2c
MD5 f14217433d997a608e611b8ea46977f2
SHA1 f2abf96c4d0de1d43b39ca6b036a861013712a5c
SHA512 a25dbc14e45d575057100b24ad2a1c9d9355165c5fdbeafe593e68b80dda9b1c5c3b3fb7c7f4ca4ec8215383738dd0d19117c96d8f4331582eee7308e676a1ef
SSDEEP 96:pe8aFTkrC25rgFukvMTYYnDeQHP2XYYnDeQHv:Y8Ak3MLuDeA2ouDeu
TLSH
T16CB13F4057F60219E5B74E79ACB5AB219376BD45CE079FCF1340A21D8C30125EA3D7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98135334-5a7e-46a4-bb64-6d3f6cd16237.tmp

Path C:\Users\Admin\Downloads\98135334-5a7e-46a4-bb64-6d3f6cd16237.tmp
Size 9KB
SHA256 786b925de9386e9a130e78108f77017a47e917ee1617b4399730499622d2c891
MD5 4a9aee08dcb844ffda6d0898d485e4a4
SHA1 1925f66a2e99bc417dc590ebced2679782b2399b
SHA512 6584d36fe13ea1b9040a28121f281c4f6b8a9f441fe27733f8762c1c38ea33694a754a104fc5a5f66d7bd871f98f4fecb51dc23cfd637c21c3d7529ee8d96be0
SSDEEP 192:sblt5QpJaxJ/rxsQ1X6nIhluJvKUgkWMmRkej1EeHT8:/pJMvJQnIEgEmR7jXQ
TLSH
T1A812BE4F78605CEAD0278FF562BB4ADD582DA60CC7EDCC36400F928154E22D13CA5A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Anubis Beta 0.9.9.1.jar

Path C:\Users\Admin\Downloads\Anubis Beta 0.9.9.1.jar
Size 20.2MB
SHA256 20a03c38a39d013bf5f6836818c0b665478eb3381181fd372cd661c438fd752a
MD5 e8f5e1e4a7b4ee4e99e4518c318dc1fd
SHA1 50548b8dd5e4d9a1a9cb99dda32ccb75a446650c
SHA512 40507864700fa08bee8591e96bf79a0adf1ad67eab78971a9b90116c8c16a46cfcc0446d54caf8ed79de304630dca85148303f966e1f0ca9f029f4d7a532d7ba
SSDEEP 393216:3cwzJYMAOBBwk0hVnjQ9lC4CTYVVnLslT+JjKO8zZrlAIKXHXTZhcC:pzJYMAOJ2Vjal7BBhp8zDATlhN
TLSH
T12D2733027EEDE17ED81B9772C011C1626D3421C85A0BA44FBE79078E4EE4D574B9ABEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

boot.txt

Path C:\Users\Admin\Downloads\boot.txt
Size 1KB
SHA256 f2ee0d28fb1498e8d73be66c394769799cada020df6f31892d800558a3ffaa10
MD5 d0a70c4c1792af40e95c253ab63e2124
SHA1 0b4721b976f46551cb92a6ed9ff4eea004765ac8
SHA512 a4064b2d28258a460f64355e50e93b3d7cfb7b81ac99b65f6a158064b030542d369914c0b84afaa24b739cba09de64c369025d6f5787e54e7e5f41a1c636d566
TLSH
T127117C2263F60388F6F71B4D16B709740A7B3D95AE3AC61D029C550D4BF3A8499A0BB3
MD5 SHA1 SHA512 TLSH

Submit Download

cf803954-bc8b-402c-a0c7-0ea0ce04bb23.tmp

Path C:\Users\Admin\Downloads\cf803954-bc8b-402c-a0c7-0ea0ce04bb23.tmp
Size 15KB
SHA256 0dda16e3c1fcfaafd6c87d3eb18d6987d9e8d957ed37648ca24894f577bea595
MD5 e54153d0ca099af6a98b9191f593f1b8
SHA1 7549d60786a08e95fa5c40e2b37c3c40d6bfbcfe
SHA512 47c2f0604739d83acdab93725d10b6b89e211c454abb3a26b0850591cb195ee987261427545d1a6a4335c3e0a2e9ae52cac1116da4fc8ebc4e32596c6174d114
SSDEEP 96:J8pU88yEHy4Gcm8GIRgehGORBQUBRhx2L7M+KquvF3EBU6l0SmMGd17d8RRXJ:JI8yESTcm2RGOdBR2LYquvVOla3D7dGJ
TLSH
T1AF72B31579C9DF1BC983BE391C59C5AD0292FC01FF29F0873956B32F613ABC0892160A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB5A6.tmp

Path C:\Windows\Installer\MSIB5A6.tmp
Size 412KB
SHA256 ddfcd04f2ef5a87b8732f552460f7491576607d7c674e1783021c09c42279371
MD5 168c58eda31144be9a857905be57cfb7
SHA1 31c6e24890d4758e3719b0044e38d0fcd3350c24
SHA512 fd7c68901ba3c17e8d4ee29b77fec7c5f5acff21d4d0ad8466f83bf3060dea2e594e6e7e0cf3c645c7ecead813a4f6125157f1e8413d811c1174a867c804f974
SSDEEP 6144:P9n7J9PsUtPDEzbKBYq+dwzO6wgmpm9r6ck+XJzRbc:Fn7J+UdYzbVduYgWmtk+X0
TLSH
T1D6946A29B3E418EDE4B68276C5A78034FF75744D3320D5AE87A8952D2F3B6A070BB705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 df0889c80a92508c606c5250edcb2db04a7c89f0d64a2b5df0e9bafceb5b2964
MD5 1c0a0d4007502cc2500a212c6545d3c2
SHA1 6e5fad5c6ef30bbaeb5721b811b1051b6dba4322
SHA512 254f581e23ab13f2e3de917821a92ffcc217fdad13a50c103f08b9e9106dbde0e43c6808cdb7ed12c5fbff33a4cf989e1c098f21a6382bdbc4209ea7505af5de
SSDEEP 24576:vu8m+1zEdoO/vvTLb2t+oGqZc0UjVVdSBLGtPic1l0asOqEgIP1UlbGRI:Q
TLSH
T1E247A3243AF92110E7B79E3C6CF0AA234D3A7D5B9C199E8D45411F4E0921FB0E972F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2f1e274e-20d3-49ca-9d54-6f3f6f62235e}_OnDiskSnapshotProp

Path \??\Volume{c9561ee0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2f1e274e-20d3-49ca-9d54-6f3f6f62235e}_OnDiskSnapshotProp
Size 6KB
SHA256 3e5e815c32298bcd4dade136b30194c8307a671d2cb6e853028c9c22611a5e82
MD5 424945dd7e4e3c263dbb8a73073a0da6
SHA1 4d173482d2dd2eaaf2482a0247e36d3ab15b3cc9
SHA512 286e74c778c5d87895490706fc03607b258bc176b498dd9757e6892abc44983e71d44e59012e3a042cf71595dbeee2e8bea8968a74b557549d51eaf7828ef9cb
SSDEEP 96:FKTtIPvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:E+b++ZVm
TLSH
T1E2D178085AE54711E2B3AB7129F18557A877B911EF33CB8E0298238E2670A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/780-317-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-544-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-513-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-510-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-508-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-507-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-506-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-492-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-491-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-489-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-487-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-486-0x0000020AD9960000-0x0000020AD996A000-memory.dmp

Download

memory/780-485-0x0000020AD9950000-0x0000020AD9956000-memory.dmp

Download

memory/780-484-0x0000020AD98D0000-0x0000020AD98D8000-memory.dmp

Download

memory/780-483-0x0000020AD9990000-0x0000020AD99AA000-memory.dmp

Download

memory/780-482-0x0000020AD9710000-0x0000020AD971A000-memory.dmp

Download

memory/780-481-0x0000020AD9970000-0x0000020AD998C000-memory.dmp

Download

memory/780-968-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-480-0x0000020AD9700000-0x0000020AD970A000-memory.dmp

Download

memory/780-479-0x0000020AD9A30000-0x0000020AD9AE5000-memory.dmp

Download

memory/780-478-0x0000020AD9930000-0x0000020AD994C000-memory.dmp

Download

memory/780-469-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-1066-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-468-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-465-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-1081-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-462-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-458-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-455-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-452-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-1156-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-449-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-446-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-442-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-439-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-348-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-345-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-344-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-342-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-340-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-339-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-337-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-1201-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-328-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-327-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-322-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-320-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-316-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-315-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-313-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-309-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-1830-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-308-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-299-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-279-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-249-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-248-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-246-0x0000020AC0520000-0x0000020AC0FE1000-memory.dmp

Download

memory/780-218-0x0000020AD99B0000-0x0000020AD9A26000-memory.dmp

Download

memory/780-217-0x0000020AD98E0000-0x0000020AD9924000-memory.dmp

Download

memory/780-216-0x0000020AD9720000-0x0000020AD9742000-memory.dmp

Download

memory/2712-1868-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1873-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1875-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1877-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1883-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1885-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1887-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1889-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1908-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1911-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1913-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1915-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/2712-1919-0x0000022875F60000-0x0000022876A21000-memory.dmp

Download

memory/4028-1682-0x00000196A8D30000-0x00000196A97F1000-memory.dmp

Download

memory/4528-505-0x000001AC6D1E0000-0x000001AC6D1E1000-memory.dmp

Download