solaris_loader | ccb29f6036010cfb90e879740e1850969fce7531fa82cc6b65af0930951b9ed9

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/10/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe
Size 30.4MB
Sample261021-2pcgqsys7k
SHA256 ccb29f6036010cfb90e879740e1850969fce7531fa82cc6b65af0930951b9ed9
MD5 a71b64a31a5986355ad0f74afabc13e0
SHA1 142796c211f17b791df84bfbabd48865f33c25a0
SHA512 1f5056265c493a3cc8fd438da1c6a68d90105343637549844909cd8d151cccc23049a5a9b4f7cbc18acba16ce4d43cd75d7ce9aa9f78ff064d68f8d54f4ee75d
SSDEEP 786432:6DLO//AWFYSVAnTA4nvMi/WbiB0o5gqWySLvLIZ:6DLO/hVAnk4nU3A02VJSjLI
TLSH
T1316733A517A659CDC9938C7E7E62CA021031FC26A8EC744F53C4F74B4EBB11427E4BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery downloader execution solaris_loader svcstealer installer loader persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

solaris_loader

Version

193.178.158.57
193.178.158.107
196.251.107.186

Signatures

Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
loader solaris_loader
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral1/files/0x000b0000000243d4-3.dat	family_svcstealer

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4528 created 1644	4528	02clu0wr.exe	109
PID 4528 created 1644	4528	02clu0wr.exe	109

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243d4-3.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243d4-3.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral1/memory/2884-51-0x00000201F2B40000-0x00000201F2B42000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral1/memory/3320-113-0x00000000029D0000-0x00000000029F1000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243d4-3.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243d4-3.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243d4-3.dat	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243d4-3.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243d4-3.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Downloads MZ/PE file 4 IoCs

flow	pid	Process
36	2140	synchost.exe
39	4528	02clu0wr.exe
127	2140	synchost.exe
154	2140	synchost.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	synchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	avdgttcy.exe

Executes dropped EXE 16 IoCs

pid	Process
4336	avdgttcy.exe
4528	02clu0wr.exe
1560	xiynlr8m.exe
4144	y6i021w3.exe
2564	da9n2wwf.exe
4760	umo4n321.exe
2140	synchost.exe
3548	ke28l4tm.exe
1260	syshost.exe
3968	SuperCookies_patched_NATIVE.exe
4920	ke28l4tm.tmp
3148	svchostxmr.exe
3592	ubgzp.exe
888	syshost.exe
3800	synchost.exe
5872	synchost.exe

Loads dropped DLL 1 IoCs

pid	Process
4920	ke28l4tm.tmp

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\svchostxmr.exe"	y6i021w3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Syshost = "\"C:\\Users\\Admin\\AppData\\Roaming\\syshost.exe\""	umo4n321.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SuperCookies_patched_NATIVE.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4528	02clu0wr.exe
3592	ubgzp.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1952_303237235\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1952_303237235\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1952_303237235\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1644_421807168\manifest.json	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\synchost.job	synchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4376	cmd.exe
5896	cmd.exe
3228	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 7 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	avdgttcy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	avdgttcy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	02clu0wr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	02clu0wr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	synchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ke28l4tm.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ke28l4tm.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ke28l4tm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ke28l4tm.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4212	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x000700000002446f-45.dat	innosetup
behavioral1/memory/3548-47-0x0000000000A20000-0x0000000000B33000-memory.dmp	innosetup
behavioral1/memory/3548-389-0x0000000000A20000-0x0000000000B33000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{B42C04A9-BC5D-4A63-BE17-090F59DC305D}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\WasEverActivated = "1"	sihost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4528	02clu0wr.exe
4336	avdgttcy.exe
4528	02clu0wr.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4528	02clu0wr.exe
4528	02clu0wr.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe
4336	avdgttcy.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3320	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1952	msedgewebview2.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe
1644	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4528	02clu0wr.exe
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeDebugPrivilege	3592	ubgzp.exe
Token: SeDebugPrivilege	888	syshost.exe
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3804	RuntimeBroker.exe
Token: SeShutdownPrivilege	3804	RuntimeBroker.exe
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE
Token: SeCreatePagefilePrivilege	3320	Explorer.EXE
Token: SeShutdownPrivilege	3320	Explorer.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
3320	Explorer.EXE
3320	Explorer.EXE
3320	Explorer.EXE
3320	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4376	cmd.exe
3228	cmd.exe

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
3320	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 4336	372	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	84
PID 372 wrote to memory of 4528	372	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	85
PID 372 wrote to memory of 1560	372	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	86
PID 372 wrote to memory of 4144	372	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	87
PID 372 wrote to memory of 2564	372	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	88
PID 372 wrote to memory of 4760	372	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	89
PID 2564 wrote to memory of 2140	2564	da9n2wwf.exe	90
PID 372 wrote to memory of 3548	372	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	91
PID 4760 wrote to memory of 1260	4760	umo4n321.exe	92
PID 4528 wrote to memory of 2884	4528	02clu0wr.exe	51
PID 4528 wrote to memory of 3320	4528	02clu0wr.exe	56
PID 4528 wrote to memory of 3804	4528	02clu0wr.exe	60
PID 4528 wrote to memory of 3512	4528	02clu0wr.exe	62
PID 4528 wrote to memory of 4688	4528	02clu0wr.exe	65
PID 372 wrote to memory of 3968	372	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	93
PID 3548 wrote to memory of 4920	3548	ke28l4tm.exe	94
PID 3320 wrote to memory of 2244	3320	Explorer.EXE
PID 3320 wrote to memory of 1752	3320	Explorer.EXE
PID 3320 wrote to memory of 4596	3320	Explorer.EXE
PID 3968 wrote to memory of 1952	3968	SuperCookies_patched_NATIVE.exe	100
PID 1952 wrote to memory of 4724	1952	msedgewebview2.exe	103
PID 888 wrote to memory of 3320	888	syshost.exe	56
PID 1952 wrote to memory of 2900	1952	msedgewebview2.exe	104
PID 1952 wrote to memory of 2900	1952	msedgewebview2.exe	104
PID 1952 wrote to memory of 2900	1952	msedgewebview2.exe	104
PID 1952 wrote to memory of 772	1952	msedgewebview2.exe	105
PID 1952 wrote to memory of 4876	1952	msedgewebview2.exe	106
PID 1952 wrote to memory of 4876	1952	msedgewebview2.exe	106
PID 1952 wrote to memory of 4668	1952	msedgewebview2.exe	107
PID 1952 wrote to memory of 4668	1952	msedgewebview2.exe	107
PID 1952 wrote to memory of 4668	1952	msedgewebview2.exe	107
PID 3968 wrote to memory of 1644	3968	SuperCookies_patched_NATIVE.exe	109
PID 1644 wrote to memory of 1144	1644	msedge.exe	110
PID 1644 wrote to memory of 4212	1644	msedge.exe	114
PID 1644 wrote to memory of 4196	1644	msedge.exe	115
PID 1644 wrote to memory of 2688	1644	msedge.exe	116
PID 1644 wrote to memory of 4196	1644	msedge.exe	115
PID 1644 wrote to memory of 2688	1644	msedge.exe	116
PID 1644 wrote to memory of 2688	1644	msedge.exe	116
PID 1644 wrote to memory of 4476	1644	msedge.exe	117
PID 1644 wrote to memory of 2020	1644	msedge.exe	118
PID 1644 wrote to memory of 4476	1644	msedge.exe	117
PID 1644 wrote to memory of 4476	1644	msedge.exe	117
PID 1644 wrote to memory of 2020	1644	msedge.exe	118
PID 1644 wrote to memory of 2020	1644	msedge.exe	118
PID 1644 wrote to memory of 2432	1644	msedge.exe	119
PID 1644 wrote to memory of 2432	1644	msedge.exe	119
PID 1644 wrote to memory of 2432	1644	msedge.exe	119
PID 1644 wrote to memory of 736	1644	msedge.exe	120
PID 1644 wrote to memory of 736	1644	msedge.exe	120
PID 1644 wrote to memory of 736	1644	msedge.exe	120
PID 1644 wrote to memory of 4100	1644	msedge.exe	122
PID 1644 wrote to memory of 4100	1644	msedge.exe	122
PID 1644 wrote to memory of 552	1644	msedge.exe	124
PID 1644 wrote to memory of 552	1644	msedge.exe	124
PID 1644 wrote to memory of 1472	1644	msedge.exe	125
PID 1644 wrote to memory of 1472	1644	msedge.exe	125
PID 1644 wrote to memory of 1472	1644	msedge.exe	125
PID 1644 wrote to memory of 5416	1644	msedge.exe	128
PID 1644 wrote to memory of 5416	1644	msedge.exe	128
PID 1644 wrote to memory of 5424	1644	msedge.exe	129
PID 1644 wrote to memory of 5424	1644	msedge.exe	129
PID 1644 wrote to memory of 5860	1644	msedge.exe	132
PID 1644 wrote to memory of 6128	1644	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Modifies registry class
PID:2884

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Users\Admin\AppData\Local\Temp\2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Users\Admin\AppData\Local\Temp\avdgttcy.exe
    "C:\Users\Admin\AppData\Local\Temp\avdgttcy.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
      4⤵
      PID:4544
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
      4⤵
      Executes a command shell one-liner
      PID:5896
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1236
- - C:\Users\Admin\AppData\Local\Temp\02clu0wr.exe
    "C:\Users\Admin\AppData\Local\Temp\02clu0wr.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4528
- - C:\Users\Admin\AppData\Local\Temp\xiynlr8m.exe
    "C:\Users\Admin\AppData\Local\Temp\xiynlr8m.exe"
    3⤵
    - Executes dropped EXE
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\y6i021w3.exe
    "C:\Users\Admin\AppData\Local\Temp\y6i021w3.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\da9n2wwf.exe
    "C:\Users\Admin\AppData\Local\Temp\da9n2wwf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Users\Admin\AppData\Roaming\synchost.exe
      "C:\Users\Admin\AppData\Roaming\synchost.exe"
      4⤵
      Downloads MZ/PE file
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      PID:2140
- - C:\Users\Admin\AppData\Local\Temp\umo4n321.exe
    "C:\Users\Admin\AppData\Local\Temp\umo4n321.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Users\Admin\AppData\Roaming\syshost.exe
      C:\Users\Admin\AppData\Roaming\syshost.exe
      4⤵
      Executes dropped EXE
      PID:1260
- - C:\Users\Admin\AppData\Local\Temp\ke28l4tm.exe
    "C:\Users\Admin\AppData\Local\Temp\ke28l4tm.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\is-U5QJ1S44SX.tmp\ke28l4tm.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-U5QJ1S44SX.tmp\ke28l4tm.tmp" /SL5="$7026C,3938845,1062912,C:\Users\Admin\AppData\Local\Temp\ke28l4tm.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:4920
- - C:\Users\Admin\AppData\Local\Temp\SuperCookies_patched_NATIVE.exe
    "C:\Users\Admin\AppData\Local\Temp\SuperCookies_patched_NATIVE.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=3968.2076.16211882004589899088
      4⤵
      Drops file in Program Files directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffc3f9bb078,0x7ffc3f9bb084,0x7ffc3f9bb090
        5⤵
        
        PID:4724
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,12233347961478716702,76840633917997733,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:2
        5⤵
        
        PID:2900
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,12233347961478716702,76840633917997733,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
        5⤵
        
        PID:772
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,12233347961478716702,76840633917997733,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
        5⤵
        
        PID:4876
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3560,i,12233347961478716702,76840633917997733,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
        5⤵
        
        PID:4668
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4464,i,12233347961478716702,76840633917997733,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
        5⤵
        
        PID:5136
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4456,i,12233347961478716702,76840633917997733,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
        5⤵
        
        PID:2184
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4384,i,12233347961478716702,76840633917997733,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
        5⤵
        
        PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/+sm4Wl7PcIFljMjIx
      4⤵
      Drops file in Program Files directory
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffc3cdec188,0x7ffc3cdec194,0x7ffc3cdec1a0
        5⤵
        
        PID:1144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,10386121028152995964,5564008842279347836,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,4044663727119449990,54345281752970651,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
        5⤵
        
        PID:4196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,9708244838061326342,4180217869546695542,262144 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
        5⤵
        
        PID:2688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,12175088345671205526,8787548781369517552,2097152 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
        5⤵
        
        PID:4476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,173095884859077653,1913008202911303201,2097152 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:2020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,5026139395354745969,4867568764747564265,2097152 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
        5⤵
        
        PID:2432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,4735302809044308554,5467052042174580546,2097152 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:2
        5⤵
        
        PID:736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,16027800798701181852,4950347617699918767,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
        5⤵
        
        PID:4100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11650446321809285318,9469376022924307301,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
        5⤵
        
        PID:552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5380,i,5902617673560964170,13058081726642459107,2097152 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
        5⤵
        
        PID:1472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,15784421160235631494,14393539030266599318,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:8
        5⤵
        
        PID:5416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,12734050452091336180,11766401593540055519,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
        5⤵
        
        PID:5424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,13900214281357178881,2292903147370534428,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
        5⤵
        
        PID:5792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,13900214281357178881,2292903147370534428,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
        5⤵
        
        PID:5860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,18239724706125251469,14543033474351933536,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
        5⤵
        
        PID:6128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,800365518776238417,10890411058131646595,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
        5⤵
        
        PID:5200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,9093899090012433495,11039440519875179529,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
        5⤵
        
        PID:2348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,299252255492763511,12705259694732506581,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
        5⤵
        
        PID:5668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,9444793202947239925,7062747930182648568,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
        5⤵
        
        PID:4084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,15236732782356908166,14286086302795594371,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
        5⤵
        
        PID:5232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,13369850042379863317,10254753398208777615,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
        5⤵
        
        PID:6004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,8928871553057818599,8045304514746608712,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
        5⤵
        
        PID:6008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,15687893005711877598,1529951596187146845,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
        5⤵
        
        PID:1544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,8044697980039922913,16002214051385663399,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
        5⤵
        
        PID:5908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,11166151638264378679,7191194173222251684,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
        5⤵
        
        PID:5576
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /d /c start /b "" "C:\Users\Admin\AppData\Local\Temp\ocvx1oge.exe"
        5⤵
        Checks computer location settings
        Executes a command shell one-liner
        Suspicious use of SetWindowsHookEx
        
        PID:4376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,4629675824035665536,12245632712116733935,524288 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
        5⤵
        
        PID:2936
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /d /c start /b "" "C:\Users\Admin\AppData\Local\Temp\ss4qya73.exe"
        5⤵
        Checks computer location settings
        Executes a command shell one-liner
        Suspicious use of SetWindowsHookEx
        
        PID:3228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6380,i,5179239708970969190,10521604783020166211,262144 --field-trial-handle=2988,i,14434401729613205087,3583006960686910296,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
        5⤵
        
        PID:4560

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3804

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3512

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4688

C:\Users\Admin\AppData\Roaming\svchostxmr.exe
C:\Users\Admin\AppData\Roaming\svchostxmr.exe
1⤵
- Executes dropped EXE
PID:3148

C:\Users\Admin\AppData\Roaming\b5fa1457-8da4-46ec-9ef9-9108e7d45ffc\ubgzp.exe
C:\Users\Admin\AppData\Roaming\b5fa1457-8da4-46ec-9ef9-9108e7d45ffc\ubgzp.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Users\Admin\AppData\Roaming\syshost.exe
"C:\Users\Admin\AppData\Roaming\syshost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2348

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2296

C:\Users\Admin\AppData\Roaming\synchost.exe
C:\Users\Admin\AppData\Roaming\synchost.exe
1⤵
- Executes dropped EXE
PID:3800

C:\Users\Admin\AppData\Roaming\synchost.exe
C:\Users\Admin\AppData\Roaming\synchost.exe
1⤵
- Executes dropped EXE
PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Debugger Evasion

T1622

Modify Registry

T1112

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1952_303237235\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1952_341866682\crl-set
Size 13KB
SHA256 b85327be29f5d0a5be4a47da5bf5062f5115bda5e9827db40ac4776d829ccd18
MD5 5111ab39b220749a299b5bb7cd25c730
SHA1 970c9013ee629ded1b5d2a058cd147950c3544ab
SHA512 37caae776f5d9365367e12a6ca13e07761f09b3cf6d1f9ea9523af89e6f2579afdd148d3942822358a49ac597a544c30bdf070aee051d69d8a0adab6f6af708a
SSDEEP 384:oeYPnEDMU2kk0yu7uCnglcJUoCzL4pv2W9cBTgE:ojPEoMk67R1UoCwV2W0cE
TLSH
T16152AF4FDDC4A62AF03911AE982262A412794A8552554B731B6C3A64BCFB28D4E38C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1952_341866682\manifest.fingerprint
Size 66B
SHA256 7ad6d17bd7b1bf49425f7efe322f4a9065446eca71d3ea1ebe0a838efcb08e95
MD5 fa32cf839f99432676ca9acccd8a0550
SHA1 9a869d2475f9840495188509e12ce9ca5a9e7189
SHA512 b1e901d92adecc46f96f52ac38954688f0a2514710041109785656ffe694766448cdbafcda397e9edb196763997d952537ebfefb4e5d128954576024f8856c04
TLSH
T1C5A00216AEA0E812F29486DEC4254B6A14372BF9AE76008979E8E4819C87260815B8D5
MD5 SHA1 SHA512 TLSH

Submit Download

690253d5-5cf9-4dc6-b1e4-7f91b675d26e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\690253d5-5cf9-4dc6-b1e4-7f91b675d26e.tmp
Size 18KB
SHA256 e0b62bac1105aa0552693d2fa3e217934c541e1d354d4b88878248749dadabd5
MD5 ed81648781183d32cdb002f7fadc3f95
SHA1 097b6096fd2a2819a6839a0e75496f78b98447d2
SHA512 a8cd00b1f893056369b8d1d2e007cf168c7d194f0e077fbacfd4c8812d6308f110574a4be2f933ecf7dd118263b3d293d7abc90ff259ae56dc7ced4a77e34a12
SSDEEP 384:noQkUSvysNSUVlog5CEIBGYX5E2P7ZgDR4iSo84wCUsA8rIIlX:gygVyGYu2TZCR4iiVsBLl
TLSH
T1F5826B75A8B9AC3709E6A551F54B36539FA46037EAC05F54EAEE4F0C01C638C230B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

994786e4-49f2-4531-bc11-1cf15bcc4bd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\994786e4-49f2-4531-bc11-1cf15bcc4bd2.tmp
Size 28KB
SHA256 45f606168e11840b79c56383c59a43d8510709704c893b0c32abd77b760ed6b0
MD5 65906855364ec8d6127cd78b99086a04
SHA1 1f4ac7486fdc392314177336e08ca4e15e442c05
SHA512 fb20d690443d4c32aba47be391d0dbbffb768735807fc73bc39840508b8ae985a4ebecbd1a1ed839cd2131c5e414cde5bd556c873fb9d7655bf69d2441bff919
SSDEEP 384:nUiFVQkUSvodsN38TUNTUlIlSlog5CaIBtDf4mYX5E2P7ZgDn4iSo84wCUsA8rIy:vFvSiwgqvyymYu2TZCn4iiVsBLl
TLSH
T1DBD2A4F598E79937D8AE8783A73E2D429EBCD163B5845984BBC91D0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

34ce3e30-da97-4830-8e7a-8f0a4501f5d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\34ce3e30-da97-4830-8e7a-8f0a4501f5d0.tmp
Size 10KB
SHA256 0a6397f4b152950da7d54176db5be944f88cfb1a264dbb91df612d010a416bdf
MD5 fa4f858d021884b4c6d164095361ddbd
SHA1 f2017864282afd3150cb275b84d34880626959b1
SHA512 5f9580f2f0a429bd925c2266de10122289b9850c327531a1858b4164295c88f9da1c9f37e51f140cfb5a89611ff69d483b2536cdd6195efb8169ab2e26f7ff28
SSDEEP 192:sxZSRgbZD/fQs9mvIdpXeHW6+WNc7Tc/YgKyv+UIg56J:sxZSgD/fQs91uHb3/FvY
TLSH
T1BC32B956AE24A97B8CC7E21DBB25BF53E6F91031A1D11E44AAFC861C05E77DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70fa49f4-fdf8-4c88-b9d5-fb1cb78dc56b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70fa49f4-fdf8-4c88-b9d5-fb1cb78dc56b.tmp
Size 11KB
SHA256 409c1ff522c29bd38f9163fd0be2eec1c45fea6a2254c9c688975f25a1027f95
MD5 58a67e80a036396101a97bd2ce7f10dd
SHA1 0b54233703680bfa5847f93caac0d6b042b6c7b7
SHA512 53bc16a17d746fc6866646d57ff767828b62961dc96626af99ef0a524539ffb6d8f615d10c0adac570b011e16125ef357e29badfad3d986bfc05f5f6f1a8f2f1
SSDEEP 192:sxZSRgbZD/fQstmvIdpXeHW6+WNc7Tc/YgQ6v+UIg5cJ:sxZSgD/fQst1uHb3/pvW
TLSH
T14232CA16AE24697B8CC7E21DBB25BF53E7F91032A1911E44AAFCC61C15E7BCD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 293B
SHA256 b80db7b6267246c27cd95619a832abc145c2244ca13e726390c6a526bf34650c
MD5 02aa48974db054dfbb70b5faedcb9429
SHA1 4020ec2b94694e99f70657327eca823e223d7d10
SHA512 05a40f2c3b4f01dfd8955561aae0959531a58079cf39179be1c4a247ced478f3fe4b1b938518869843c36179328512cce5caf51fbae29cdd1d30a2df51ef6496
TLSH
T17CE02B1D45D0C76E6314E4DB0A75871D8E88636EE7C07A5E5F10C948308F48CA596AA2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0b10e80450c0e4c81bf596e50050e38738ac25dc9a7d493363dd10dd2eee582a
MD5 828ad2cfccf423916baeeabc3e9a23c8
SHA1 21441ae63cff108ab12a64f05af2735cb5df4e41
SHA512 c03c4f3b1910d57a5839a1da1212114b20b47dc0d5571876da54f8443b633f1a5010a72c966b5f7b3a84433375ccadc85daf81badfd8b6363098d8f5714737f7
TLSH
T140E0209C05C4C31DB10CE8C70574874CC394379F93C4695D2714D58570CD04CA681960
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 39dd1c5b1210d6c94d9186a09155588bd3d54ff5b7377c6f870ad3fbc9d9ee1a
MD5 366b6f75385deea9a4edaaafcd3042a2
SHA1 b6da1b9e06cde8333afb33b515120363eed0269a
SHA512 619ed8bcd0fbb2b67e250bf7628d6af3b5b31edfe89a7f922ded9303a2a4961f4ed5c58aaa0343937f6b1ecd1187035512f5e01fc2bda77a5e890f6c8b42a8f5
TLSH
T1D2613CC515DB84AFF7A6AD3485E830C73A7716A143E72F7305B9E83B5E067B98450053
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7e55c24ec91c1032095a2954e7a6d0d73c9690fbfd7ad8fbac5a9fb9ae3d1234
MD5 2653dca6bc52105caae7c15935f8d695
SHA1 7cd0b36d59f699fdbfd1b0f4b16bc45dcaf865a8
SHA512 940ad43a35283947d767fd628aeac622911d1cd50edbac4bf693ff2b2a26e9d0ca8b4b055b1fd352a132d2688c0023145eec5eb1f3e732521dda65ef8d555d01
TLSH
T18C615CC511DB80AFFBAAED3489E830CB3A3706A003E32F7301B9D83B5E063A98040013
MD5 SHA1 SHA512 TLSH

Submit Download

5b59bec6-7a3c-4640-a2b2-b6d7568e09af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5b59bec6-7a3c-4640-a2b2-b6d7568e09af.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

207f3313-5d81-4707-8c74-53785901fc9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\207f3313-5d81-4707-8c74-53785901fc9c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

473b6422-0977-49fa-b00a-bceef946d54c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\473b6422-0977-49fa-b00a-bceef946d54c.tmp
Size 1KB
SHA256 5485de818fdfeb6d5930923e3b4fa5bdd3cb24f1aa5879cef41e44ce5ca5857e
MD5 bad72b7b28e63c9b69cedb66cc2c6f44
SHA1 8c711f97c865af67bd5977f53676b6986d202934
SHA512 ee24e1636eba085e459c0e490a7ea14dbec46f4f4c1d6e580f5cfed27f433e67e585565d0d74ab1b5e5ec5fc24bfbfe1e5bed2bd431d08c9361313d9b37e2bd0
TLSH
T1B841ACF7C3F9866E890195F0BA146E2BCE5E0955432C3D4AC8E4AE1B93E2471D240A8E
MD5 SHA1 SHA512 TLSH

Submit Download

b68e6c31-f16c-447b-add5-e9cbc78e12bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b68e6c31-f16c-447b-add5-e9cbc78e12bc.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 f9350af378457ed11002c7a1e8f4aa053f9c140f4b6c3c43ff119ceded8f7fa6
MD5 2e808014be0bf5164bc6ad6c4dc49aa5
SHA1 08dc5ee942ffcc84734f68baaddc718a94686c57
SHA512 d9883fd93a46c6e7779a9f859b685b06940d47bd1eca2db5273fd3165479e77810c258bdecaeca2ac6674009460a559f3916c4bf97ee3226d58e23bf3f469eb0
TLSH
T193216F14B12787C82C7D1E0C4A6894979A7332753024E5AE777841768BAEF10ADBC7C9
MD5 SHA1 SHA512 TLSH

Submit Download

c91ecae4-c29f-4477-8748-202a5728a7a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c91ecae4-c29f-4477-8748-202a5728a7a1.tmp
Size 32KB
SHA256 0b03f29f1a059af8296b3eddbdc33bfbe2dada2cf084da0bbb8ce31c0ddd623f
MD5 335679a4b97483fbbc8abc9d4348d9aa
SHA1 0876b5511f2f14417eac1799365780b3f89d7ccd
SHA512 46beb05bd88a8ee7525a70120017a45ac5db56733af100c84d1a920d654d3c0a7208d1723b0af351ff36ec3652826b35fef7fd3b72d77eabff178b685cf0dd53
SSDEEP 768:6Tich1B7pLuLjrPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyNn+LlEKXz1roc:6Tich13EjrPWvPZplu1jaDNn+LKgzOY1
TLSH
T19DE2FA7B680CCA7E4FC04A9DDD1A7F9E6DA8028B9698CD4047FA945C02C77EE51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb4c33ea-da12-474b-b594-cb9784aa3df6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb4c33ea-da12-474b-b594-cb9784aa3df6.tmp
Size 10KB
SHA256 6da7712d0f3628edcbfbe5651bede415f31b972110debccdede8dda6a3c36959
MD5 55c3dbb5b6996921210d77f28c57494a
SHA1 7e3cd4495f6110bce9a908a99195801f6fd2819a
SHA512 4418d49a59e0a633ea38771bc633e70667d91e96255724a5549e8850ce7f8a460884b99baed47488328b15b03c6e549f2a4b20c74e160f777f83d528c9e8f7ad
SSDEEP 192:sxZSRgbZD/fQsQmvIdpXeHW6+WNc7Tc/YgKyv+UIg4J:sxZSgD/fQsQ1uHb3/Fvc
TLSH
T1F722BA56AE24A97B8CC7E21DBB25BF53E6F91031A1D11E44AAFCC61C05E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1891a88-7025-4099-bf62-f583b81399d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1891a88-7025-4099-bf62-f583b81399d8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43376dfb-2a6c-4ef6-9f68-abe51d969d28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\43376dfb-2a6c-4ef6-9f68-abe51d969d28.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

f38b1a45-1220-4dfe-bfe9-9f437b203d6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f38b1a45-1220-4dfe-bfe9-9f437b203d6e.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d8fedd46-4f0a-4f2e-ab4b-d5fa61a62790.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8fedd46-4f0a-4f2e-ab4b-d5fa61a62790.tmp
Size 8KB
SHA256 bce00731cf75632b66266bf072b135e98b0d11e45e90c0ea16983593c9df4a5b
MD5 40303c7bc57396108591dad8ffd89675
SHA1 5eb9394ae5d647cab6cb79dfd099634f69452f35
SHA512 944b2b3cdbdc536775b23e4b88c570b58ccf1f5fdada6a824243380bbd1a6b1d3ec28ce5a954b961d5184ea9d9a2e731057a25cae45e14850f6440c63c7cfd5b
SSDEEP 192:oONY6Dph0qQmiUynp4wGYX59ezvCP7ZgD+kIIdq5cMfU6:oONY61Hg4wGYX5E2P7ZgDX4U6
TLSH
T171120875E8B9AC775DD7B455F48B36139EA4213BEE80AF44D5E90A0C00CB38C270B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e869b317-aabc-442e-9566-62b24c971c02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e869b317-aabc-442e-9566-62b24c971c02.tmp
Size 8KB
SHA256 acd50805a546191bd7b481adc8251fb1feb559b090780370588ac5bc1a2ff828
MD5 771069d145772637c2e39b20b0e785f2
SHA1 7c824996c1d22479a19ea3646a375171b6fc310e
SHA512 b02f70606fbdb5726d776e5c644ad4159206e516391efe88580cb098e7e02d70bd4bb8f91dc5ab14cedd133495bb848b3e664f5fb6b6aefebaefca27e7336eb2
SSDEEP 192:LJONl6DphmqQmiUySpq8wGYX59ezvCP7zkk7dKU6:lONl619DRwGYX5E2P7rsU6
TLSH
T1F202E935E8787CBB4DE3AE55B44B2B139FD4213BAA906B84DAE80A1D01D764C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61ebf1c2-3b77-43ef-affd-b92f41f77606.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\61ebf1c2-3b77-43ef-affd-b92f41f77606.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f1912c37-aba6-4729-b15a-d82bf76f4f99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f1912c37-aba6-4729-b15a-d82bf76f4f99.tmp
Size 18KB
SHA256 ccb365982c82599f6bd80b36f91f5312c8a7790ea06938fb2637cf38012ff4bd
MD5 09de84fac2ef6b451526ebf80baacf43
SHA1 ef059fec4b44bf5a98da2cae63767c797d3d2bce
SHA512 ec5230cf41918966d7c3618b34523063efd9db48b1890d2e7f032a7c4df63d1fb654e8beb9be45a16ee4838b7d78565087199918068ef654861d75efbfd3ce50
SSDEEP 384:neQkUSvysNSUSlog5CEIBGYX5E2P7ZgDR4iSo84wCUsA8rIIlX:OytVyGYu2TZCR4iiVsBLl
TLSH
T18C826B75A8B9AC3708E6E551F64A3653DFA46037EAC05F54EAED4F0C01C638C230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fb6eea1f59d5e47996c3a87397e7510ef0ddf1f71b171398a42e91b3906e0e69
MD5 318c9e45bcc11ca0b31c68a393ba947b
SHA1 abd59b3efcc8f32507d971cec147938e6334f4c2
SHA512 213687bc6ef332f5ad06484397fa3f22e77d7ffd9dde2300098d5bed311c810084d14a6fa42d81e6aac7180f37a9147adbd4c963bfa29c11ae6e337b1392c0a8
TLSH
T1A0415A5CBAEA1159B3B37F56AFF6696D447EBD772E0AA05D00110E4F0A27A00C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

02clu0wr.exe

Path C:\Users\Admin\AppData\Local\Temp\02clu0wr.exe
Size 83KB
SHA256 f188f3e59c098976883bbe83cc9993d87e64ae1b10a2224d86ef794de5604b9a
MD5 9d4234782e8737f5f606043b91882a87
SHA1 a6fd9fbf49856547f265c6fa95903d7f15a5a43b
SHA512 54b0837919508a6fde1aa0c269e278458f8d9182e3b7d9746620182c1869b66c7c42812593e279d372c988473aa13fbccf3ad5e41fb18706f95f789a30fa8bb9
SSDEEP 1536:DjrW7lTbC/m0/phiUfjeuE2uJPADGPVW9xiX7VzQx6d4yrqDw:frW7J0/phiUfjRutADJ9kX7V0x61rSw
TLSH
T1BB834975A3DE02F6D813CA38E9A4123BD371F041BE31570F4234DD1D2FA25A5BE58A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1F92122390B440DCB364.exe

Path C:\Users\Admin\AppData\Local\Temp\1F92122390B440DCB364.exe
Size 24KB
SHA256 eb9d2bff879e6e56588d3a2c199d1d2927aa5e828af33a595e52664f94662fd6
MD5 8e02b70cf6fd2e6e6415fc646597fc9d
SHA1 d53a456cd3eb94fdbc148372c4426afae9c44db5
SHA512 161a73fb13940c70f16ca6b4b21c9479730f33f6958856dc505f09b813cfcc01abf6f3e12ad44af9fb6ff7a5b2f4fd1536877ed230e076d64cfd3af51a2ee10b
SSDEEP 384:F40+BGDP/Rg4wsx99Pt7UNxyGarY4pP1Rl/X1fjbq1+Z1FrzxAqJY:F4lEO4nD74G3pPZFXq1+Z1AqO
TLSH
T178B23A179346D977C53E833601FA992ABA771A3035134DB3DBD884750A9C5907C3BACE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91408fec-5d08-48ed-9583-50b6f8ff3ebd.tmp

Path C:\Users\Admin\AppData\Local\Temp\91408fec-5d08-48ed-9583-50b6f8ff3ebd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

SuperCookies_patched_NATIVE.exe

Path C:\Users\Admin\AppData\Local\Temp\SuperCookies_patched_NATIVE.exe
Size 13.5MB
SHA256 daa5451231e4a347c7cd4d3f89c47341a93ceb5e79dbea529a66dab413e05eca
MD5 a69eefb9dc5de1311d8ab34cc7495470
SHA1 23fdcb7954539fd9965363441b4923ce4bdb13b5
SHA512 ffc776f32bcce263f42c4f33a17761167dbe8acce45117578fe53993d548e7013811a2192f7c6b9cd1d3fde94412a17d3608f7a846d38c26bcf22e1f0a455fb4
SSDEEP 98304:Miyfy3ljOeK3FDjYUhbx5g4HZP7v6HQIiS8Fj4yytIM+5VE:MiCeOeUFDj/15g45L6HQIl/IM+0
TLSH
T12EE64A07E86505E9C5AED534CA629223BF717C485B3023D72BA0F2643F76BE09EB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6a9f574-af6c-439d-958f-e4c780445582.tmp

Path C:\Users\Admin\AppData\Local\Temp\a6a9f574-af6c-439d-958f-e4c780445582.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avdgttcy.exe

Path C:\Users\Admin\AppData\Local\Temp\avdgttcy.exe
Size 2.3MB
SHA256 4fa32a38c241987aeea4ac35654bec272007b635893669b8b156cb91b2af5306
MD5 df5839771fb7206fc8c54b87752c8f85
SHA1 be2f33ebec5abd0f4aaf57cce4f8e0d8f398887f
SHA512 e8eb9f037631b1b5e26b0347b485e46b1825853820f98adb14f1d3da6b0f75be7feca4398aa850c5ef2e8a651384b83fd95ee75f45e017280ed2a17936a3e914
SSDEEP 49152:l9sI30IOPHO0HKrNEXR2Z3Au/PJvTs69:jXaXRa/54
TLSH
T113B59E5AA3B801FDE0BBC274C9565A07D7B2B8061670D79F13D4479A2F23B716E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da9n2wwf.exe

Path C:\Users\Admin\AppData\Local\Temp\da9n2wwf.exe
Size 529KB
SHA256 ce0d27a44176caf7e574ca69bb38d8f20880fb3f8a694c41696d24edcb7f4129
MD5 b8961dde0920a57932994bbc4131c161
SHA1 b49ccfeefcf25308e4dcf6cc6a4d942bf925688e
SHA512 1dc61eed0dd5a6e075e5b68f51eea20a1c41e46ed980130a094b9f82d7dabc4ba02fa671cc24f69c245fef1784059a7f25d751d962b7e20632b8d5feb539513b
SSDEEP 6144:NjLNrSV/lRyH3foOsYlf0lPcRbLG9qSB5Vh69yRyQllVP9TlMXmjCohgyAqjT4pZ:hL5w0HDsY1acR/EP6M5FuwCoZAsE
TLSH
T176B45B5AA29943FCE07BE07CD9475A42F639744703B18AEF039045772E572E2AF7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\dia_abe_240740234\Chrome\Default\cookies.json
Size 452B
SHA256 2f960cb618a1ff1dbf6b689a4dbae80371a94358dae3fd259cd4862187353b15
MD5 08783f844a5818130172b6a14749b71f
SHA1 ff80bab20d6ea452610196b99579315253b7136d
SHA512 71b9159dccf35c71f626e9b7768463d544e4562b96382c4bfb7ab01c57d0787eaceb16e7b17f0693d962901a6e45a657af0cc310f6562e8181aebe74fe728649
TLSH
T13FF0DC7A10C59622C86BAF3149027F6E39314B215A9CED9C64478165095DC7092214EF
MD5 SHA1 SHA512 TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-Q4PNI0AH8V.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ke28l4tm.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-U5QJ1S44SX.tmp\ke28l4tm.tmp
Size 4.4MB
SHA256 ff0b740631c3ed5bdf660e26ca3174f0a28b94cac3c9eb07bcd636ed59635927
MD5 e2cd86805ddda170f7647c3136f14728
SHA1 afdd794307bfa5f79f685aaa4b1a330ba4ba9d9f
SHA512 3b27f469578ae1dc8f67f5faa4d023a6dfd0b2a9c73410ef0b54235c9531ca8fe5f906cc7f8d926ade566758394e07e956d88688bce5b30d01814a5b4244ef16
SSDEEP 49152:LoPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lO5333qM:Lgw26xBij3QG+ddr9/OzGbRwm333N
TLSH
T131265C13B244E53AD4661A3B483BB648583B7F3D3A168C476BE4FD4C8E397406D2A787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ke28l4tm.exe

Path C:\Users\Admin\AppData\Local\Temp\ke28l4tm.exe
Size 12.9MB
SHA256 90ec1278f94f0df467d06aaf7459da70b5f2387199fd143313a1ef1c200aab5a
MD5 ee1dcda7210a0a4287402788a6e360fe
SHA1 f310f4be44676eda63e0c8c3fc4e69d5408f6f12
SHA512 3a1b6dc14968d67b59c5eb2edb95c0212e66e1f703b09255c7404d2c0d578ba9bd57010ca45654ef4107c08f25c827fb3d9edbe7db5be9daf440c7b878afa9d6
SSDEEP 98304:XAX7CeHAMxicqIC4O26tDZNypY8XvyOt3U04e253ak:OCbcqIm0VXLk0ixX
TLSH
T14FD61237B28AE53EE06E0A355A76B110543B7E2DAD138D0A96E4F45CCF353603E3B646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ocvx1oge.exe

Path C:\Users\Admin\AppData\Local\Temp\ocvx1oge.exe
Size 35KB
SHA256 6a17419227d5d680bd5d0cff1ce9d8eba6efb66757162879ed20f063d4507216
MD5 2bcd6aedc616e70cd9b5360ef5f85609
SHA1 ec77f85b493a48ca03a115fba993f4bad382225b
SHA512 c8bcb06ea307bec7460d2c5423897d07b485838fdde01cb05f5cb5232f44601e7843741b07a9ec5513894a68b2242d0803150843e2515c2c65646ff3e564f678
SSDEEP 768:RqRavh9V37o7t8jJLyFaKPjIr3HTq5XpT8nUw4o:RfvPV37o7SlLMb4UXl8nUa
TLSH
T1B3F2079AAFD70FE6C45614B8D296ECDAC87F76093234809A972B1431DF3D865763CD20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1644_769681704\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1644_872576895\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7b86422-df8b-469a-95ad-56909ad7ce1f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1644_872576895\d7b86422-df8b-469a-95ad-56909ad7ce1f.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ss4qya73.exe

Path C:\Users\Admin\AppData\Local\Temp\ss4qya73.exe
Size 35KB
SHA256 17bb37fbfa264f5aaf0b6f2bbe1726031f15a28ed4910541f8481c62654cb2b9
MD5 c3e09df81fb919d7c78d7da657db7f14
SHA1 5ee2cccf3c18f7633074e02f67bad1c09574f717
SHA512 5ec414c84f19e44f2593afee58f48ea87bb7ddc1e1f76a592cdd950f002b32ac4269e567cb50dec67184792a02d022e77da4828ae6157d381652dbbc87d8be6d
SSDEEP 768:eXEJ61DNJtKhZckMWf4gMSbD4SAblnRJac8Q:XSNXKhZzMWfHMnSApf7
TLSH
T118F23A0E52E510FDD22F917DE68A2542E276780607429AEB47B14F770F33AE2793E381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xiynlr8m.exe

Path C:\Users\Admin\AppData\Local\Temp\xiynlr8m.exe
Size 620KB
SHA256 a668e0f7c669ad39bcf6ac0f2f367d0e39515786272084dc130fad1c88a5d59b
MD5 26b4b7cb8e2b55072a4d3e1e6fb7ef30
SHA1 5f33e27939ec29532a1f1b0875a5dd954cc8c7c2
SHA512 e4ae640f0e80617db7f9619c10d530bd2e52a18ac36085d647545f824557a5a3ec49e359f0ab713bb0e4bd02f0d03bb13a7a8dad691ffed75e613ac7fe40490f
SSDEEP 6144:73DQ73r/dI7LI+iix8/mRlR2InxCcMHSOX/revKmY+WCTNZil10lAJtxcGUvVocu:LDc7Mx8/ilR2IxCYo1T72vmcpXrr
TLSH
T1C5D47C56EBE502F8D17BC1B4CA829956EB77B815433065CB03E209675F3B6A05B3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2941085b-7891-4f75-84cf-25e6929d4248.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\2941085b-7891-4f75-84cf-25e6929d4248.tmp
Size 4KB
SHA256 6440671079e48c404af6901bfaaf437c6a321555fc010c41331a08ab4ec21c11
MD5 e3496ec9f0e5d5006524a16240edde28
SHA1 d7d82e2a7bba476a175c626f0389f65d5f7f3380
SHA512 141930fdc9cdc770b44aa37e3df03fa56d20d4cb20be9024d90f0018f77f482df5a06702262a0336ad3d89e946864cd5505840f682eccfe011a81756b37f57ac
SSDEEP 96:zuJBbNkCEOfZWvmT8Frh/cInURoDoto+5ZnDmB1ZNfEP6Y+ZP+OTWlHa:z0BbNbNszooDUhl21ZKGV
TLSH
T19D918321A4A4AA374EF2D945B9493F43B7A59037D5917FA8C9EC0F0C02EB2DC2346C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35e1a992-a148-46b1-9522-a53838974066.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\35e1a992-a148-46b1-9522-a53838974066.tmp
Size 16KB
SHA256 4bdc9fcb73bf136e90d5339999538e778f73a5cc53b598a6eeb52cc64bb4ac6a
MD5 e55811e3522bc8d6ce9e18ff408dc2a2
SHA1 2873413011f90165a9c2c96ac1250be50ff48239
SHA512 73ce2429d4518150c50053520016e52455c37eb55817fc0e7114d60479de17c6070d010a26a9d6fe6251bcabefb709064378a176a68b5b9c719b40a68640bd33
SSDEEP 384:zC+OBqImmJvGBLx3NaFMJFNNb+jqy9Scg6rp:zcvGtlN4H9Rt
TLSH
T13672AF6928B55A232CE7C849BA8D2B47D7616167C1D1BEE8CDEC5F0E132F09423A3D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4946d1fe-41ed-4062-b9cd-0ad201cc3c68.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\4946d1fe-41ed-4062-b9cd-0ad201cc3c68.tmp
Size 1KB
SHA256 84eb0b938ac1f0cdc09cc00c12735efeea20b1666e8b087b1de9ee0a5b356c2d
MD5 69d6b9e33324ae5078b853e5a30b6939
SHA1 9035d4bc6804fc40124164d869f00633bdf935de
SHA512 ffa901d549972240a862e83db7d2b06d1203c7b64db6d176846ad9b5efc0072ef82f943cc49e18ada53d2f23f7825fffc916084c7d865bddcaf395ec82aa0eaf
TLSH
T1D9319072E4C02B725ED2A88672512F87AF20503A82118E8881CD0B1C22AB6DC662FC33
MD5 SHA1 SHA512 TLSH

Submit Download

7d2a2f83-aca0-4183-a1ff-0e0f05800fa0.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\7d2a2f83-aca0-4183-a1ff-0e0f05800fa0.tmp
Size 17KB
SHA256 2efcf22e2a9412bb52b61052c42bdef506b23a8e90af8273fe457d5333ce5326
MD5 9527c09038142eebaf1c4fbe6c84fd7a
SHA1 72753e94e8d23f277dc7e0ab9adc167338c23932
SHA512 c43973a3aad1a25988f8f24910e41a6058f774897063e5d8805d67d82d05c7345c2c60c7a607553e09e56f9f882cea580778dc0f54ace55d3177baebaf3b7971
SSDEEP 384:zG+OBqImmJvGBLx3NaFMJFYNbnjqT+VS9Scg6rp:vcvGtlNy5VS9Rt
TLSH
T1B582AE38A8A19A232CF7C589BA4A7B87D7706263C1C46ED4CCDC5F0E035B19C2357C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\CertificateRevocation\6498.2026.10.20\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2575af3105f61c3d95e91f1852de04d57a6e42fdca3585600c2c13f2c39d8c0c
MD5 fc024cd57ce64ac0ad90b13f17bf0960
SHA1 42601ebf842ef999b8d87269775d79b9ece9a82e
SHA512 53577c6dfcff190d5c353e2b0d752bf75b3479ea34c9e913d022e8bdcf46c64d636f729e9322d40cd226b78879f0a35ae9fab6cace115f5d9781dc60236a76c5
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d7fdd6bdaa84475c01d175f98fbe6136fcbdb41f4e8ba4656b74419bdfdfd083
MD5 44976301a8d15cabbef85ceeb88869fc
SHA1 9899eea44df4036b92009053d3f4fe8e1aa330f9
SHA512 ff9eb90d089b05bcffa900089189ff3386fd275f4e8fedf0f054e63c81e90d10b572b7731d92a58a8dd27e576850657c81a9e46e01f083db4e0a7c47aacac7ad
TLSH
T1ADD0243333151174C03434333043F51C14C1C11F41455040D43DC55D1F044704D13451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

1366820b-18e0-493a-9220-75ebcc8c3534.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\1366820b-18e0-493a-9220-75ebcc8c3534.tmp
Size 6KB
SHA256 92a937e4c1eb78c35cfa1742453436639c04b2cab59eb9411c4276f2efcd25d1
MD5 75626f83ce3263ef07ac6d3cf942dba4
SHA1 8705e4aad378a1331ae11875e8c1039161731660
SHA512 f1fa175b4b535ab0c696e68bc9b699a7fda56d84bea42b4bc8de163d77cd75e5bd15dc588ca6c2514f68681d548a3b1f49349e9aec4ad5b221f7757026ecdea5
SSDEEP 192:stHW0q+fAZ8paIP/S+WiQ4aTQ0wYLrdLfOM8:stHjq+Hj/VCw68
TLSH
T1E4D1A6025EA869774CC7E619BA35BB52E3FA103265D41E98EFFC851C09DA6CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 20d5145e9be91cbfb9ec0ea20f3935a111c7e730169ff9dd97bb1d04897de91a
MD5 c9175e803c3afe9c91c2344446746853
SHA1 3256fe9c69d03d629ac48e7dcca1e7395fc6c476
SHA512 d000b293d84e158d36d07232f94bdbb5be17de3f3e2d5e3c65ebca018b0ee55d6c6759c4259cdfc9f4c8d9d5c1653d0da6d8bafd793d3ec4cc492b138162e40e
TLSH
T190B0128044500082E5000330A4C20D4431304C152902011210D41396C426B908719172
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 5c551372833185f8d44094c13daeae3eba0c80d9124594091250154ea77a632a
MD5 53511bfe9f6ff0e3f855e0da28dd2659
SHA1 5124bd6b80dbebd232ee6ab7ab2d7fd7c1368d6e
SHA512 ba66924524a6b55bfa0bbb356b5c6879b689f18cd0b9e7aed41137aefed908639ddcfa69b99d41c8dec005d3ab2a23c6c4c3b277c7ff3e14dc5499e4b5b05c3b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 c8d4cecdaef592340ee8f52f6c985d6d263d791e9c0f11bd5d0e90c2e5db59e6
MD5 c1368834181321cca0db65479e3e6027
SHA1 aa824e4abd1101bdcbe9f04019bd8021b5407e9f
SHA512 7bf58bbfaf681738f34c2756e8b3692f55269edc8e1119233b0772c83e41534b6e4359a55fe3bb3265c47575ecda8f44119ee08a46b64cd1db963b71a3ea6ee5
SSDEEP 3:LstlNllkll/lt:LsX3lEtt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

9c0280ce-d553-4650-85f1-bb556acec3af.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Network\9c0280ce-d553-4650-85f1-bb556acec3af.tmp
Size 821B
SHA256 229161701dde70739e53b9646ff88bdc1f967c763ff2e50faa0c4fefa1211e1c
MD5 dfc39cc14d2fa1ff426b7ff145a5a202
SHA1 8549d350ddba09be3f737aae02db9b4936f66e84
SHA512 81b55280e7b6c5eb8620c6e1e6ff83b4611841d125d79dbb2bcac2657057efaca61f89a679c293a4774477879fa81c857489ad172a035fff830a080240c55b93
TLSH
T1A70182B6C3E4C67D494112E427247813CD2E151912282E27DDE6EBED5BE1475D71064F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 f8cae1f8abb7cc331a47c693180a44162e62ad62639164cc6109ddc9704cb6e0
MD5 c604fb2114e582c449ab89d381dc5378
SHA1 eeb2ade5c95c3852ee4c4386bf50232328440ecc
SHA512 7168d0e7d7a462fe8e8475f4292f8fca7714bbbd579cfbae8eee720ecd2ac0f5463c1c83aa9ab094ec734a30867a7b0ef76a4f8b82fa293c49d9b6a7f7171619
SSDEEP 192:stHW0q+fcZ8pFIP/S+WiQ4aTQ0wYLrdLfOM8:stHjq+LK/VCw68
TLSH
T1C4D1B7025EA8697B4CC7E619BA35BF52E3FA103165D41E58EFFC852C09DA6CC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

bbab046d-50f4-4cc9-8379-c8461c29d116.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\bbab046d-50f4-4cc9-8379-c8461c29d116.tmp
Size 6KB
SHA256 cda8cbd17837a122ccd07206912c0debd7df7e509f4a499417da5aa64c246be7
MD5 bc1e3bd7af34a8f92895dc805c8fd5af
SHA1 8eed6c442940daac41e2b9d8b78362e909b49ad3
SHA512 ab0fb2cd618f45463435879f17e1b0ded4c388c59a428bb083bdcb67a10b53f0bd8a6ee32967f5be2dc74460b31c6ae3784873a8a1cea833c6baafe40de2ad05
SSDEEP 192:stHW0q+fAZ8paIP/S+WiQ4aTQ0wYLrdLEOMC:stHjq+Hj/VCw/C
TLSH
T115E1A5025EA869774CC7E6197A35BF52E3FA103265C01E98EFFC861C05EA6CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Local State
Size 1KB
SHA256 99003487218c4baad082f57323f02b77aa71f343d761c604d1142e8fcf96f8dc
MD5 6e2eccdccedb78dac4ced8ea3aef5f41
SHA1 94129fd3a302d16b5fc6bb8d6a9f8fa8b10f44b7
SHA512 e74556323def5610fca0db39e55c11f84e5d2294441c661e73be056903181f25b522d75c8fc24064c5dd92cd92efab52b55fd5c48eaf77bca9b9f1e523cd583b
TLSH
T168214072D4C56AB6AAA2AC85B2616F8B6F50503A82509F5C91CD071C23AB5EC563BC33
MD5 SHA1 SHA512 TLSH

Submit Download

b98608cf-6f78-42f1-a231-5e7bcac7d2ab.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\b98608cf-6f78-42f1-a231-5e7bcac7d2ab.tmp
Size 3KB
SHA256 831f2e3732d11821ec95a0b4ce67ce93dcafb351c70c323e9cb03f9b42579822
MD5 b56b99baf72463247050fd0cb6160c28
SHA1 d551116607f41c91edfab1f282a63dcccfddbd6a
SHA512 6d0bfe07a9998e61c9c1d6b8131fcbe4786f6c5167eb09d6f9f0c116be42f6801f68daad17c11f275ff4bdafb5ff8ea482ffdaaf413feb6d86dee5f4a9021795
TLSH
T126716326A8A4AA374EE2D944B9852F16F7655037D5917FA8CAEC0F0C02DB3DC2356C17
MD5 SHA1 SHA512 TLSH

Submit Download

d04f0893-da08-4532-96b5-d2561b962c75.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\d04f0893-da08-4532-96b5-d2561b962c75.tmp
Size 2KB
SHA256 56aa63b0e2a791ce20b662a843594570accc0830b5601713debb26998139f873
MD5 56f9587850ac998a75ecab9187729d1a
SHA1 a0f5d4184940f686db3d61ee0e9302ceb2617dca
SHA512 3d895601230481e5f5a437128be733d3ba759068f6366ef54dc533281db84d7ceaa3b948f7ee72d8fe766fd4f2e38872b704bc683e18ccb2826b4a2b66d8786d
TLSH
T16151B832B8846B778AE3994479493F53EB35A036C6516FA49ADD0B1C02DF6DC2306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

ubgzp.exe

Path C:\Users\Admin\AppData\Roaming\b5fa1457-8da4-46ec-9ef9-9108e7d45ffc\ubgzp.exe
Size 83KB
SHA256 a6629b7b3c9e3fe8284fb9c1207e8719bd0f71a6c120dd2cebde765bbfad008b
MD5 51dd14cfc73629960cdf3e15fca449a5
SHA1 6783fb47e6c6499e6619dedab79355815ac6f733
SHA512 c89516fa1ac3ca6bb53b7920e20594f35d9399da3d4ee57c02596b3e9e40e1933aebbcf3dcd727d29b447efd5f1170a71ecaa41ed55c1befad72a991d71faf6f
SSDEEP 1536:DjrW7lTbC/m0/phiUfjeuE2uJPADGPVW9xiX7VzQx6d4yrqDk:frW7J0/phiUfjRutADJ9kX7V0x61rSk
TLSH
T1A9834A75A3DE02F6D813CA38E9A4123BD371F041BE31570F4234DD1D2FA25A5BE58A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchostxmr.exe

Path C:\Users\Admin\AppData\Roaming\svchostxmr.exe
Size 160KB
SHA256 3fcd91299895aa6ec381aa4a94d6880ce22d9d41c897e020b3dd90372771b361
MD5 2895b3e51ba74818140efee2d1ce4cf7
SHA1 1d2209daddb33780811d9e4fb3a6d5010b67d656
SHA512 9f9fd92008ebac194973c69dd93702d42056e2fcb7182f31c4e589c190ed5a41c84aac3c60af248e04c1115f71aa47fde1136900a0ec36cb00031b4f98d6b915
SSDEEP 3072:CNX8oWfHMnSA1Lqq+jOWPN7SO3M6KSnvpH9Si:CNsoWfydLqxZ7FMWo
TLSH
T165F35A0BB3A524F9E1778239C8A51A06F772783217618BEF03A407765F632D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

synchost.exe

Path C:\Users\Admin\AppData\Roaming\synchost.exe
Size 526KB
SHA256 5dc3ef3862dda1c7f3d289f52cffcd13f182dc393ca6b71fc6bcd95f7e8e9845
MD5 b5efb0e380735de832f10d767f0a165c
SHA1 66e02c27539e98132c2c4dcc3075f4ee56fee1c7
SHA512 d75a5c8852e8d66d78377a31cafcb054ac3e4faf8fff2d78c51771cdb0148140e45032fa9e8081f5247c4315e9c3fe34bddfd955c12fe96cdea5dda39e799a3d
SSDEEP 6144:jLNrSV/lRyH3foOsYlf0lPcRbLG9qSB5Vh69yRyQllVP9TlMXmjCohgyAqjT4pZ:jL5w0HDsY1acR/EP6M5FuwCoZAsE
TLSH
T19DB44B5AA29943FCE07BE07CD9475A42F639744703B18AEF039045B72E572E1AF7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syshost.exe

Path C:\Users\Admin\AppData\Roaming\syshost.exe
Size 226KB
SHA256 4b20f08354cc3f000b49e7e104ed8c76720438bb6987e1e6eaef13cf9d359051
MD5 c0a26ad005c824abf68ff8145855301c
SHA1 35d1f0b442f0c2c66e82441b9e5de2ab32159423
SHA512 57c9862902ed72aa80909c4a6d864afb69ca2d2d650005f93b1883886caf7a88d5e754ff482e3a0be43692731b9431ff043045651da225fbd5e64da3a6a5899a
SSDEEP 3072:cu7oXKl1K+qYfq2p8/tPKEVVuoSA8TzIqOn4M0vyyGQ0MA8/Z/ho3oMqHqcKdP:/AKlYPYIPn/uJHJOn4MctZpXVKdP
TLSH
T1DF345B1A73A508FBE836823DC8931A06E772B4160761CFAF0764066A5F277D19D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2184-1226-0x000001D562AE0000-0x000001D562AE1000-memory.dmp

Download

memory/2184-1217-0x000001D562AE0000-0x000001D562AE1000-memory.dmp

Download

memory/2184-1221-0x000001D562AE0000-0x000001D562AE1000-memory.dmp

Download

memory/2184-1222-0x000001D562AE0000-0x000001D562AE1000-memory.dmp

Download

memory/2184-1223-0x000001D562AE0000-0x000001D562AE1000-memory.dmp

Download

memory/2184-1225-0x000001D562AE0000-0x000001D562AE1000-memory.dmp

Download

memory/2184-1227-0x000001D562AE0000-0x000001D562AE1000-memory.dmp

Download

memory/2184-1224-0x000001D562AE0000-0x000001D562AE1000-memory.dmp

Download

memory/2184-1215-0x000001D562AE0000-0x000001D562AE1000-memory.dmp

Download

memory/2184-1216-0x000001D562AE0000-0x000001D562AE1000-memory.dmp

Download

memory/2884-51-0x00000201F2B40000-0x00000201F2B42000-memory.dmp

Download

memory/2900-141-0x00007FFC5A3D0000-0x00007FFC5A3D1000-memory.dmp

Download

memory/3320-79-0x00000000029C0000-0x00000000029C1000-memory.dmp

Download

memory/3320-116-0x0000000007940000-0x0000000007965000-memory.dmp

Download

memory/3320-77-0x0000000002810000-0x0000000002811000-memory.dmp

Download

memory/3320-53-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/3320-114-0x0000000007940000-0x0000000007965000-memory.dmp

Download

memory/3320-78-0x00000000029B0000-0x00000000029B1000-memory.dmp

Download

memory/3320-113-0x00000000029D0000-0x00000000029F1000-memory.dmp

Download

memory/3548-47-0x0000000000A20000-0x0000000000B33000-memory.dmp

Download

memory/3548-389-0x0000000000A20000-0x0000000000B33000-memory.dmp

Download

memory/4528-22-0x000001A3D8FD0000-0x000001A3D8FD1000-memory.dmp

Download

memory/4528-20-0x000001A3D8FB0000-0x000001A3D8FB1000-memory.dmp

Download

memory/4528-21-0x000001A3D8FC0000-0x000001A3D8FC1000-memory.dmp

Download

memory/4528-19-0x000001A3D8FA0000-0x000001A3D8FA1000-memory.dmp

Download

memory/4528-18-0x000001A3D8F90000-0x000001A3D8F91000-memory.dmp

Download

memory/4668-256-0x00007FFC5A3D0000-0x00007FFC5A3D1000-memory.dmp

Download

memory/4876-167-0x00007FFC5B040000-0x00007FFC5B041000-memory.dmp

Download

memory/4876-168-0x00007FFC5C170000-0x00007FFC5C171000-memory.dmp

Download

memory/4920-862-0x0000000000AB0000-0x0000000000F21000-memory.dmp

Download

memory/4920-390-0x0000000000AB0000-0x0000000000F21000-memory.dmp

Download

memory/4920-1011-0x0000000000AB0000-0x0000000000F21000-memory.dmp

Download