solaris_loader | ccb29f6036010cfb90e879740e1850969fce7531fa82cc6b65af0930951b9ed9

Analysis

max time kernel
31s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/10/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe
Size 30.4MB
Sample261021-2pcgqsys7k
SHA256 ccb29f6036010cfb90e879740e1850969fce7531fa82cc6b65af0930951b9ed9
MD5 a71b64a31a5986355ad0f74afabc13e0
SHA1 142796c211f17b791df84bfbabd48865f33c25a0
SHA512 1f5056265c493a3cc8fd438da1c6a68d90105343637549844909cd8d151cccc23049a5a9b4f7cbc18acba16ce4d43cd75d7ce9aa9f78ff064d68f8d54f4ee75d
SSDEEP 786432:6DLO//AWFYSVAnTA4nvMi/WbiB0o5gqWySLvLIZ:6DLO/hVAnk4nU3A02VJSjLI
TLSH
T1316733A517A659CDC9938C7E7E62CA021031FC26A8EC744F53C4F74B4EBB11427E4BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery downloader execution solaris_loader svcstealer installer loader persistence spyware stealer trojan

Malware Config

Extracted

Family

solaris_loader

Version

193.178.158.57
193.178.158.107
196.251.107.186

Signatures

Family: SolarisLoader
SolarisLoader is a Windows loader written in C.
loader solaris_loader
Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects SvcStealer Payload 1 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/files/0x000f00000001c597-3.dat	family_svcstealer

Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c597-3.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c597-3.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects Reflective DLL injection artifacts 2 IoCs

resource	yara_rule
behavioral2/memory/4408-21-0x00000235C1CB0000-0x00000235C1CB2000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader
behavioral2/memory/3984-65-0x00000000037B0000-0x00000000037D1000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c597-3.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c597-3.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c597-3.dat	INDICATOR_SUSPICIOUS_GENInfoStealer

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c597-3.dat	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c597-3.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Downloads MZ/PE file 1 IoCs

flow	pid	Process
17	4160	synchost.exe

Executes dropped EXE 14 IoCs

pid	Process
3048	avdgttcy.exe
5272	02clu0wr.exe
2780	xiynlr8m.exe
1768	y6i021w3.exe
5744	da9n2wwf.exe
4160	synchost.exe
3160	umo4n321.exe
1112	syshost.exe
1332	ke28l4tm.exe
2124	syshost.exe
5616	winupdatebjf.exe
2684	sptln.exe
4372	SuperCookies_patched_NATIVE.exe
4620	ke28l4tm.tmp

Loads dropped DLL 1 IoCs

pid	Process
4620	ke28l4tm.tmp

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\winupdatebjf.exe"	y6i021w3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Syshost = "\"C:\\Users\\Admin\\AppData\\Roaming\\syshost.exe\""	umo4n321.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SuperCookies_patched_NATIVE.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5272	02clu0wr.exe
2684	sptln.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\Tasks\synchost.job	synchost.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1177998714\_locales\am\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6612	cmd.exe
3652	cmd.exe
4248	cmd.exe
6172	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 9 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	02clu0wr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ke28l4tm.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	avdgttcy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	02clu0wr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	synchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ke28l4tm.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	synchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	avdgttcy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xiynlr8m.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ke28l4tm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ke28l4tm.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5560	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c5a7-58.dat	innosetup
behavioral2/memory/1332-62-0x0000000000E90000-0x0000000000FA3000-memory.dmp	innosetup
behavioral2/memory/1332-344-0x0000000000E90000-0x0000000000FA3000-memory.dmp	innosetup
behavioral2/memory/1332-903-0x0000000000E90000-0x0000000000FA3000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{C264A24E-2955-4DEC-846B-DF51E38FC199}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
5272	02clu0wr.exe
5272	02clu0wr.exe
5272	02clu0wr.exe
5272	02clu0wr.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe
3048	avdgttcy.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3984	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2840	msedgewebview2.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe
2148	msedge.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeDebugPrivilege	5272	02clu0wr.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeDebugPrivilege	2124	syshost.exe
Token: SeDebugPrivilege	2684	sptln.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe
Token: SeShutdownPrivilege	3984	explorer.exe
Token: SeCreatePagefilePrivilege	3984	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3048	3560	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	89
PID 3560 wrote to memory of 5272	3560	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	90
PID 3560 wrote to memory of 2780	3560	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	91
PID 5272 wrote to memory of 4408	5272	02clu0wr.exe	59
PID 5272 wrote to memory of 4452	5272	02clu0wr.exe	60
PID 5272 wrote to memory of 5660	5272	02clu0wr.exe	80
PID 5272 wrote to memory of 3984	5272	02clu0wr.exe	81
PID 3560 wrote to memory of 1768	3560	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	92
PID 3560 wrote to memory of 5744	3560	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	93
PID 5744 wrote to memory of 4160	5744	da9n2wwf.exe	95
PID 3560 wrote to memory of 3160	3560	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	96
PID 3160 wrote to memory of 1112	3160	umo4n321.exe	97
PID 3984 wrote to memory of 3296	3984	explorer.exe
PID 3984 wrote to memory of 108	3984	explorer.exe
PID 3984 wrote to memory of 396	3984	explorer.exe
PID 3560 wrote to memory of 1332	3560	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	101
PID 2124 wrote to memory of 3984	2124	syshost.exe	81
PID 3560 wrote to memory of 4372	3560	2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe	105
PID 1332 wrote to memory of 4620	1332	ke28l4tm.exe	106
PID 4372 wrote to memory of 2840	4372	SuperCookies_patched_NATIVE.exe	107
PID 2840 wrote to memory of 2844	2840	msedgewebview2.exe	108
PID 2840 wrote to memory of 3772	2840	msedgewebview2.exe	109
PID 2840 wrote to memory of 3772	2840	msedgewebview2.exe	109
PID 2840 wrote to memory of 3772	2840	msedgewebview2.exe	109
PID 2840 wrote to memory of 3772	2840	msedgewebview2.exe	109
PID 2840 wrote to memory of 3096	2840	msedgewebview2.exe	110
PID 2840 wrote to memory of 3104	2840	msedgewebview2.exe	111
PID 2840 wrote to memory of 3104	2840	msedgewebview2.exe	111
PID 2840 wrote to memory of 3104	2840	msedgewebview2.exe	111
PID 2840 wrote to memory of 5840	2840	msedgewebview2.exe	112
PID 2840 wrote to memory of 5840	2840	msedgewebview2.exe	112
PID 2840 wrote to memory of 5840	2840	msedgewebview2.exe	112
PID 2840 wrote to memory of 5840	2840	msedgewebview2.exe	112
PID 2840 wrote to memory of 5840	2840	msedgewebview2.exe	112
PID 4372 wrote to memory of 2148	4372	SuperCookies_patched_NATIVE.exe	113
PID 2148 wrote to memory of 2492	2148	msedge.exe	114
PID 2148 wrote to memory of 5560	2148	msedge.exe	116
PID 2148 wrote to memory of 4472	2148	msedge.exe	118
PID 2148 wrote to memory of 4472	2148	msedge.exe	118
PID 2148 wrote to memory of 996	2148	msedge.exe	119
PID 2148 wrote to memory of 996	2148	msedge.exe	119
PID 2148 wrote to memory of 996	2148	msedge.exe	119
PID 2148 wrote to memory of 3124	2148	msedge.exe	120
PID 2148 wrote to memory of 3124	2148	msedge.exe	120
PID 2148 wrote to memory of 3124	2148	msedge.exe	120
PID 2148 wrote to memory of 244	2148	msedge.exe	117
PID 2148 wrote to memory of 244	2148	msedge.exe	117
PID 2148 wrote to memory of 244	2148	msedge.exe	117
PID 2148 wrote to memory of 4940	2148	msedge.exe	121
PID 2148 wrote to memory of 4940	2148	msedge.exe	121
PID 2148 wrote to memory of 4940	2148	msedge.exe	121
PID 2148 wrote to memory of 1528	2148	msedge.exe	122
PID 2148 wrote to memory of 1528	2148	msedge.exe	122
PID 2148 wrote to memory of 1528	2148	msedge.exe	122
PID 2148 wrote to memory of 4304	2148	msedge.exe	135
PID 2148 wrote to memory of 4304	2148	msedge.exe	135
PID 2148 wrote to memory of 1668	2148	msedge.exe	125
PID 2148 wrote to memory of 1668	2148	msedge.exe	125
PID 2148 wrote to memory of 1668	2148	msedge.exe	125
PID 2148 wrote to memory of 5340	2148	msedge.exe	126
PID 2148 wrote to memory of 5340	2148	msedge.exe	126
PID 2148 wrote to memory of 952	2148	msedge.exe	127
PID 2148 wrote to memory of 952	2148	msedge.exe	127
PID 2148 wrote to memory of 3652	2148	msedge.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4408

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4452

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5660
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Users\Admin\AppData\Local\Temp\2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-20_a71b64a31a5986355ad0f74afabc13e0_cobalt-strike_icedid_satacom_vidar.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\avdgttcy.exe
      "C:\Users\Admin\AppData\Local\Temp\avdgttcy.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      PID:3048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        5⤵
        
        PID:6700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        5⤵
        
        PID:6816
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
        5⤵
        Executes a command shell one-liner
        
        PID:4248
      - C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        6⤵
        
        PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\02clu0wr.exe
      "C:\Users\Admin\AppData\Local\Temp\02clu0wr.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\xiynlr8m.exe
      "C:\Users\Admin\AppData\Local\Temp\xiynlr8m.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\y6i021w3.exe
      "C:\Users\Admin\AppData\Local\Temp\y6i021w3.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:1768
  - - C:\Users\Admin\AppData\Local\Temp\da9n2wwf.exe
      "C:\Users\Admin\AppData\Local\Temp\da9n2wwf.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5744
    - - C:\Users\Admin\AppData\Roaming\synchost.exe
        
        "C:\Users\Admin\AppData\Roaming\synchost.exe"
        5⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        
        PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\umo4n321.exe
      "C:\Users\Admin\AppData\Local\Temp\umo4n321.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\Users\Admin\AppData\Roaming\syshost.exe
        
        C:\Users\Admin\AppData\Roaming\syshost.exe
        5⤵
        Executes dropped EXE
        
        PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\ke28l4tm.exe
      "C:\Users\Admin\AppData\Local\Temp\ke28l4tm.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1332
    - - C:\Users\Admin\AppData\Local\Temp\is-TCEMC8JA40.tmp\ke28l4tm.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TCEMC8JA40.tmp\ke28l4tm.tmp" /SL5="$800A0,3938845,1062912,C:\Users\Admin\AppData\Local\Temp\ke28l4tm.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\SuperCookies_patched_NATIVE.exe
      "C:\Users\Admin\AppData\Local\Temp\SuperCookies_patched_NATIVE.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4372.896.2337797883504781547 /pfhostedapp:bbdecaae49211a314fa4ebdbf0b1b900d0cc3e5e
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:2840
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView /prefetch:4 /pfhostedapp:bbdecaae49211a314fa4ebdbf0b1b900d0cc3e5e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff6b415fd8,0x7fff6b415fe4,0x7fff6b415ff0
        6⤵
        
        PID:2844
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1796 --field-trial-handle=1800,i,8522059993931142206,105057023567905773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:bbdecaae49211a314fa4ebdbf0b1b900d0cc3e5e
        6⤵
        
        PID:3772
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2052 --field-trial-handle=1800,i,8522059993931142206,105057023567905773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:bbdecaae49211a314fa4ebdbf0b1b900d0cc3e5e
        6⤵
        
        PID:3096
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1800,i,8522059993931142206,105057023567905773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bbdecaae49211a314fa4ebdbf0b1b900d0cc3e5e
        6⤵
        
        PID:3104
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3524 --field-trial-handle=1800,i,8522059993931142206,105057023567905773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:bbdecaae49211a314fa4ebdbf0b1b900d0cc3e5e /prefetch:1
        6⤵
        
        PID:5840
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4632 --field-trial-handle=1800,i,8522059993931142206,105057023567905773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bbdecaae49211a314fa4ebdbf0b1b900d0cc3e5e
        6⤵
        
        PID:5612
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2256 --field-trial-handle=1800,i,8522059993931142206,105057023567905773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bbdecaae49211a314fa4ebdbf0b1b900d0cc3e5e
        6⤵
        
        PID:2020
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView" --webview-exe-name=SuperCookies_patched_NATIVE.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4556 --field-trial-handle=1800,i,8522059993931142206,105057023567905773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bbdecaae49211a314fa4ebdbf0b1b900d0cc3e5e
        6⤵
        
        PID:6872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/+sm4Wl7PcIFljMjIx
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x360,0x7fff68e3c188,0x7fff68e3c194,0x7fff68e3c1a0
        6⤵
        
        PID:2492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,15197017384946009299,14732739904832319839,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:5560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,16761373969013976688,11757036739363569672,262144 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
        6⤵
        
        PID:244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,8607048983138170745,15723356988014607053,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
        6⤵
        
        PID:4472
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,12105809071477266016,14879850001766578948,2097152 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        6⤵
        
        PID:996
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,12128171411881042713,6101182596888848562,2097152 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
        6⤵
        
        PID:3124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,13668702797257227740,13910586348206414604,2097152 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
        6⤵
        
        PID:4940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,2906946261050440912,5918602295874934121,2097152 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:9
        6⤵
        
        PID:1528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,11265450614183126674,12094372402790078780,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
        6⤵
        
        PID:4304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5556,i,18104562637300720685,7855177625827459701,2097152 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        6⤵
        
        PID:1668
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,4825930435894953815,8600640222530361407,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
        6⤵
        
        PID:5340
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,4527485146689242206,7766217425698082716,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
        6⤵
        
        PID:952
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,18062304442760598127,17936800608420746160,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
        6⤵
        
        PID:4856
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,18062304442760598127,17936800608420746160,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
        6⤵
        
        PID:3652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,11919361416965895309,6652220339140822511,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
        6⤵
        
        PID:6096
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,6178283497246523760,16023761374133499550,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
        6⤵
        
        PID:2756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,11390462578911059551,2100996833289958433,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
        6⤵
        
        PID:3380
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,5570444262909460315,5250773732876580688,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
        6⤵
        
        PID:4304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,7461704605285210069,7445934333499654685,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
        6⤵
        
        PID:5364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,16947629436832834500,13353944898325862216,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
        6⤵
        
        PID:6396
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,6961171033746418453,10349425586394508545,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
        6⤵
        
        PID:6404
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /d /c start /b "" "C:\Users\Admin\AppData\Local\Temp\z4qg5ib6.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:6612
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,9031859038854237671,4039331968312100039,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
        6⤵
        
        PID:6456
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /d /c start /b "" "C:\Users\Admin\AppData\Local\Temp\76tfot73.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:3652
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,14485487353116971692,2058851216876603150,524288 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
        6⤵
        
        PID:6288
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6244,i,17863295627113917680,2336977998015313088,262144 --field-trial-handle=2468,i,7903362443741835417,8581162271087021173,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:10
        6⤵
        
        PID:6844
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /d /c start /b "" "C:\Users\Admin\AppData\Local\Temp\tjut3z34.exe"
        6⤵
        Executes a command shell one-liner
        
        PID:6172

C:\Users\Admin\AppData\Roaming\syshost.exe
"C:\Users\Admin\AppData\Roaming\syshost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124

C:\Users\Admin\AppData\Roaming\winupdatebjf.exe
C:\Users\Admin\AppData\Roaming\winupdatebjf.exe
1⤵
- Executes dropped EXE
PID:5616

C:\Users\Admin\AppData\Roaming\96ee85f7-624c-44ee-8e2a-f1319432aa7e\sptln.exe
C:\Users\Admin\AppData\Roaming\96ee85f7-624c-44ee-8e2a-f1319432aa7e\sptln.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4136

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6860

C:\Users\Admin\AppData\Roaming\synchost.exe
"C:\Users\Admin\AppData\Roaming\synchost.exe"
1⤵
PID:4584

C:\Users\Admin\AppData\Roaming\synchost.exe
"C:\Users\Admin\AppData\Roaming\synchost.exe"
1⤵
PID:6284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4655482e-e8d0-40b9-96ce-e275534ddb6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4655482e-e8d0-40b9-96ce-e275534ddb6c.tmp
Size 34KB
SHA256 464a4679c26a5b9230cc7083672660ec288b784d064e300bcf188a4a68c720f6
MD5 89198996587a848dd48d4f5b3dd962fe
SHA1 8acbd2f4a9371f378ab28c550350d3cee3b3cca1
SHA512 1d7856eab1dd0a1e8ad6f80013b047bb328a7e1b634eb1ec47e941521289fddd25c8827f5404d8e59dba64f50ff88f538835002c9decdff36a23fb24252b3b81
SSDEEP 768:ON3r8Ff9c90rhtqyEMbxyJugQVTJ7vvmeXPLiVsgLY:ON3rkFyyEmxyJJq17vhLiVsgk
TLSH
T162F2AE71A8B6DC7389B6C2807255BAC3EFE011A398C90F94E9DD5E0D118739D2B4BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c2460aa-08ae-4470-b8ac-72d2c79838ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c2460aa-08ae-4470-b8ac-72d2c79838ec.tmp
Size 37KB
SHA256 2f44ba3b151881fc1458df67f2177a036b49edb3dc43bac6c5750685eff80d03
MD5 5c226cd01bfa28a99892580f035a08c6
SHA1 f724ef97fc640baef31bd545a404b43eb5d8d252
SHA512 7f69425947f13b2531a72ab0eb3e22abbbccaf61645b0f750c3d15c05e257ab3dee1ea52f7d580d874bff491639f07704eb2afbcffb9296a9cec1e0e77c5ae26
SSDEEP 768:p/UxvxjgC+k3bjf9c90zyEMbxyJugQVTJ7vvmevPSHtBk:cZj3+k3tFzyEmxyJJq17v9Sbk
TLSH
T15C03C035ACA59C7388F692843649E787EFF506B394C62BA485DD5F0E128B3AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cb05cd5-c325-4bbf-98de-f1df6f50c6c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4cb05cd5-c325-4bbf-98de-f1df6f50c6c9.tmp
Size 38KB
SHA256 168e43e5a2a42ba9ece83d4b114dadc9aa6c7d425bf760d2591fed4379569e20
MD5 3e10a3b3930204ac4d6fa6c4958008c6
SHA1 e016c7af2e5deba24680036f24ad47b19137d66c
SHA512 83fd4013df445576ed5a69761b03745bdba474f2e5711353bd5e7fd96f31589cde17e5801d8a44edf32a2e9a04a26c0d20420d6058acba8728cd46fbf5154156
SSDEEP 768:t/UxvxjgC+k3Jff9c90rhtvyEMbxyJugQVTJ7vvmeOPSHtBk:QZj3+k37FnyEmxyJJq17veSbk
TLSH
T15003C035A8B69C3389F692843649E7C3EFE505B388C61AA499DD5F0D16873AC270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6272705b-1df7-4dfd-8acf-a08a1e87f0f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6272705b-1df7-4dfd-8acf-a08a1e87f0f8.tmp
Size 34KB
SHA256 c584c16a8936ca43d16927397a66d7264cb1fd68f5fc39a83289815fff8bd058
MD5 cf87901b7a9b41ee6e597f5684b2c265
SHA1 fef5a97ef0260f18c60b6934616a2c8b28fbce93
SHA512 4cbf118b5dbad3a72cdef19cbc20a3204d4978559017159178a47b6cb36b90640aad3be4ff4c5bc3b737abcf4a2067982ca3e7820a44032d0b9e4c30ce946275
SSDEEP 768:JN3Y8Ff9c90rhtqyEMbxyJugQVTJ7vvmeXPLiVsgLY:JN3YkFyyEmxyJJq17vhLiVsgk
TLSH
T1DCF2AE71A8B6DC7389B6C2807255BAC3FFE0117398C90E94E9DD5E0D118779D2B4B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

2c109c5d-e9c8-4357-839f-ef50cf79790d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c109c5d-e9c8-4357-839f-ef50cf79790d.tmp
Size 11KB
SHA256 480197a8ca0d4e08a10c622fa7c6d97015c891a027f98e3774e1ee68a75b6929
MD5 b77c55837088ba48c3ec3350ab71887c
SHA1 068d39050d26a9170ab289a5193cf07f760d8366
SHA512 a376ffb5523fd11a877c42c6aadb1fec9f3f60df97477ffb0412cf219a5a4bba8b647c2171872ccf4b0ace3c07914b6d977b5bf35b3c9cc0f89a9ac0b95875c1
SSDEEP 192:sxRnRWC7/fjsTVGZ/SMzoA8p8x/g6+WNmrTv/YFowjGsIgVg5HJ:sxRnz7/fjsZw/S9Q/5S/YG5p
TLSH
T1F542B615AE28A93B8CD7D21DBB657F53D7F91032A0D11E48AAFC891C15EB6DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91e6bb40-cc0f-420f-8533-cf53dad4298d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91e6bb40-cc0f-420f-8533-cf53dad4298d.tmp
Size 12KB
SHA256 e9f6d927a548bb7ee64fc301e40578f43fd31f87fde15e0066fe6ad66a92fe2d
MD5 de38852ff6ef80f483dbcbf0b7afa4b1
SHA1 41db07246961770bea7789096b26ed4b59952624
SHA512 3928821d2f46887966a4caa12b0b442d686c8579e123291cea5a74659f22e55389d3366996dfb847210895519e9ce3f12bc528eca01a32276040d38cdc2d2ac5
SSDEEP 192:sxRARWC7/fjsDVGZ/SMzoA8p8x/g6+WNmrTv/YFgN2jGsIgDPg5HJ:sxRAz7/fjspw/S9Q/5S/9Ys5p
TLSH
T1C542C955AE28A93B8CD7D21DBB657F53D3F91032A0D11F48AAFC8A1C15EB6DD120381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e3bf24f3de4f249f10b9cfaf718a46c8e147585d3b5d02635867540b21b25cb1
MD5 56e8f2d05379ff24bd98bf572d0a88be
SHA1 287703a2b1bb993f3329ffccf98393024eef6b21
SHA512 426f82fcf4595b9801cbee1fdd2e547e9fa90df2e4b3b8bfbafe67fd0722c07064427dae589dc459f5b187d55ed84059f944719127656f64b8c346b302c33780
TLSH
T12961517A5BB80C52DBAE2231A5F070B33FB4D7B1A6C30D523818D47D506A32602CF59C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c55ee0b7641e4832823eb1ff20f789d8accb1ab4da5e1b63b66292798522f618
MD5 1915ed84499e1b3f20460f9c46cfce07
SHA1 24abc6573370ab752fa4025eee423e5be604f0e5
SHA512 075c133c5991130417b6460139f54de3d5731758c0fd7410ef4de143667c92f161b25f0079de92d3a2827b95b4dbe1fac0bf49d3312a171cdd772334a1ed4f87
TLSH
T1D6613F7A6B781C51DBAE2272A5F070B73FB4D7B1A6C30D533818D479506A32602CF18C
MD5 SHA1 SHA512 TLSH

Submit Download

36257967-4d56-40db-9a33-9c22109104e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\36257967-4d56-40db-9a33-9c22109104e8.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

4dcd6894-3915-4046-920d-93c2354d69c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4dcd6894-3915-4046-920d-93c2354d69c2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f71c567c-7c52-49fc-b983-3b6585bbb1b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f71c567c-7c52-49fc-b983-3b6585bbb1b9.tmp
Size 2KB
SHA256 666b1a07c91d433f7e380093fc99efe8c89df553029e6b2037c96b84c7e0dca5
MD5 a5925a1d36151eb151fa13cf03f81b54
SHA1 12ef3be5d911626b37013b54571de81ee9f3a017
SHA512 41ceab8b9efe51fc4c634cf8bca4eba1f9b0f552e9425294468cf1ff091c96d468d581b2a803bd7c0266db301836c0d9f56370f7fe03f09832e04e5ead203a3d
TLSH
T11651BDF7C7F4862E891196F0AB146E1BCE5D0525432C3D5AC8E4AE2BA3E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

b0730d9c-b41b-45eb-9f8c-78b8e1df6b88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0730d9c-b41b-45eb-9f8c-78b8e1df6b88.tmp
Size 29KB
SHA256 b798d1ea92cc705ce2ddf0f7661809b1fb5292973681ec9aca63ea970fab8eb0
MD5 e958d94f269fb8d5d9925b995be76994
SHA1 cea8314402c5adf2e2cc186674586efd948ead37
SHA512 7c40b6519c5d8efc11ec6aa4e23b60ded2477d2d3b3f5d003a2dc66c1078319aec4b49b2833c886f158e9b306f096d625e9e0a5f394c090dc91002eb062f620f
SSDEEP 768:+l2PMa7pLuLjlKWgwef4e8F1+UoAYDCx9Tuqh0VfUC9xbog/OVh3I0a01ro+PR:+l2PMyEjlKWgwef4eu1jae3Ih0O+R
TLSH
T1DDD2EA7B640CCA7F4F904A9DEC297E9F6DAC02CB9698C94047FA841D03C67EB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5ab9ff9-7c00-4aba-876c-477c4aa16a6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b5ab9ff9-7c00-4aba-876c-477c4aa16a6c.tmp
Size 11KB
SHA256 4b1a9ed6424ab8581353c6b658cbf0f796ddf810595fa8a90aacf439b56598bd
MD5 513cd164df1bdbaaee15922fa1370a86
SHA1 fb82a6d4827352b25e25ac6f16e3959eebd42ca0
SHA512 9cf62b4f060e5763f564c906858007aad9852dae73a17e91b37335372975b1d7c7e36051bc10306494b818d962528e162f8c89a55a14d928596b3a2229fa89c1
SSDEEP 192:sxRARWC7/fjs1VGZ/SMzoA8p8x/g6+WNmrTv/YFowjGsIgD1g5HJ:sxRAz7/fjsPw/S9Q/5S/Yq5p
TLSH
T1B742B715AE28A93B8CD7D21DBB657F53D7F91032A0D11F48AAFC891C15EB6DD120381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d749132f-35af-4fc5-9629-39e759c5570a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d749132f-35af-4fc5-9629-39e759c5570a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65def160-0196-4790-877b-e48dfe3f6634.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\65def160-0196-4790-877b-e48dfe3f6634.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ac510421-ff55-499c-b4d5-3b8c2df81890.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ac510421-ff55-499c-b4d5-3b8c2df81890.tmp
Size 39KB
SHA256 144a878f8c77a0341bba4169b578df2e1d7d2317ddf76d42c19c29fc2092f3b5
MD5 c2033c597f6cc6f1612a09dcd72b8b64
SHA1 9169163421d973e0ba6cdcb9d55bf1b2b6d46ecb
SHA512 1a25e3db8827a342570d06c0416ca9ea8a1dcb6a25ebea765edbf31f23b1750db37a12843dfb12c59e851ef111a0158be91f557c2546c73b54bab1a5f5bde429
SSDEEP 768:Z/UxvxjgC+Z3/AFf9c90rhtgyEMbxyJugQVTJ7vvmeXPTa:MZj3+Z3/QFoyEmxyJJq17vhTa
TLSH
T14703BF31A8769C3398B7D244724AA7C3EFF4057398C51E9899ED5F0E16873AC174B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5534514-d32f-4b29-8a34-e0621ca08717.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b5534514-d32f-4b29-8a34-e0621ca08717.tmp
Size 42KB
SHA256 95c230c1875700b0775aff3f4b4e32964745eb558a8c065d2559a04952b64583
MD5 71334bc765243702e0dbe019c68c5099
SHA1 79a2c9029298016105e6f44894459c42a26c5247
SHA512 96b862601f9a9db682a9e27cc39d8822750081c4c7260249571e19f8bd8636f40a3ce3afde4e8d4644d81a26a8b601aa82c134b3d696557debe843889a0cfeb4
SSDEEP 768:iFBn3lwgmSCgi9c90rhtWyEMbxyJugQVTJ7vvmeXPLiVsgLY:Yn3qTF+yEmxyJJq17vhLiVsgk
TLSH
T1CC1329F594D38933D9AE8783633C6D829ABCC163B4885994B7C95D0CCC862BFD747816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f0636b9-ecd6-429f-ab79-1a5bae0e46c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4f0636b9-ecd6-429f-ab79-1a5bae0e46c0.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

39b7a5e9-d87b-4ae7-a96c-8a6eec1d092e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\39b7a5e9-d87b-4ae7-a96c-8a6eec1d092e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9199223d-4339-476e-b311-a0d6bd4f911d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9199223d-4339-476e-b311-a0d6bd4f911d.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

02clu0wr.exe

Path C:\Users\Admin\AppData\Local\Temp\02clu0wr.exe
Size 83KB
SHA256 f188f3e59c098976883bbe83cc9993d87e64ae1b10a2224d86ef794de5604b9a
MD5 9d4234782e8737f5f606043b91882a87
SHA1 a6fd9fbf49856547f265c6fa95903d7f15a5a43b
SHA512 54b0837919508a6fde1aa0c269e278458f8d9182e3b7d9746620182c1869b66c7c42812593e279d372c988473aa13fbccf3ad5e41fb18706f95f789a30fa8bb9
SSDEEP 1536:DjrW7lTbC/m0/phiUfjeuE2uJPADGPVW9xiX7VzQx6d4yrqDw:frW7J0/phiUfjRutADJ9kX7V0x61rSw
TLSH
T1BB834975A3DE02F6D813CA38E9A4123BD371F041BE31570F4234DD1D2FA25A5BE58A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55ccee311adc547a_thread_hijacking_x7ajq5O4.exe

Path C:\Users\Admin\AppData\Local\Temp\10000250101\55ccee311adc547a_thread_hijacking_x7ajq5O4.exe
Size 32KB
SHA256 ea306ddff02d55a7b5ea2cd7886e213a7aa6d68dc441e6908d7bac42113945be
MD5 26c2768ced4001c30d88d73e56f169ef
SHA1 8bd05fda57c2e413499989505e89af601ce68a8c
SHA512 bec99d1471e0cdc95f62f6f0a700f60aa1a53f58f4f357c1723eb4d6514e285d3be14b345834b9af6dcb2f3bf93ce2630bb622fe940a44718d7cd55acb5559f7
SSDEEP 768:Najnc6uwN5z+sHkAXdXdTjJgm362DoYEVA:L6Vjz7EAXFdTKD2Dob6
TLSH
T12BE25D2AFDBE41B8E7ED7176120C71C5AB09FB06FF9F30BD26463043946988B6556702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

020c81a68a0e4e71_hwbp_syst_fgSLSMEz.exe

Path C:\Users\Admin\AppData\Local\Temp\10000260101\020c81a68a0e4e71_hwbp_syst_fgSLSMEz.exe
Size 32KB
SHA256 d9d7c5ff37dd34049518bddde9961a915911ce0a7e97e03ad7b242aaccb7a529
MD5 2b6ece02a56fe8ffd98320adfb21f686
SHA1 4dcee44dc110ebb4ac75f243f2d550fa3599a479
SHA512 ce907ba4630147e2c25824e8ea83fb24c32f23b9a066c3aaf9a20c865588082c3ade4aca7121a9024570c8817e5128a29020400ad7f5f3b180f4f767c1491bae
SSDEEP 768:SvxqIcCc5z0nlGn9aYKVb0fJK1ZLBypxD+:Eq/F5sG9Ib006S
TLSH
T13AE25C1BEC6A44B4EBDE707316AFB2849745FB02FF6BB0BD1987310358B5857546A302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18bc1f9b-6ae7-4ddc-ad93-fca3e0ead9ff.tmp

Path C:\Users\Admin\AppData\Local\Temp\18bc1f9b-6ae7-4ddc-ad93-fca3e0ead9ff.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76tfot73.exe

Path C:\Users\Admin\AppData\Local\Temp\76tfot73.exe
Size 35KB
SHA256 5a239488bb8e01f798223a72cadc6bd3eebcd8b8890b6fff2acb34582a271066
MD5 0b9b0a574327e962169f04ac7a9ffb83
SHA1 3a3b4ea9b28108a770af1f8b045bc426808312ce
SHA512 e9bf9c1a0ff04e79683ecaad19133328194d730f991d120075c48626dcccb3fb837c2957b0baaa9323c3a1cc160f92250532076d4592ad05547a6f316e991bd9
SSDEEP 768:27KsIFJuJLXVsU+p1q67P50/Xu4G7buXyD7ifJUdAeJT0E3rV2CqB:2WtFCpR67P50/Xu4GfxAJUd3TTqB
TLSH
T1E2F2F94F226501BCE5BFE07C9656A946D6F1740B43A196CF17E00BB72EA3AE15D3E380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuperCookies_patched_NATIVE.exe

Path C:\Users\Admin\AppData\Local\Temp\SuperCookies_patched_NATIVE.exe
Size 13.5MB
SHA256 daa5451231e4a347c7cd4d3f89c47341a93ceb5e79dbea529a66dab413e05eca
MD5 a69eefb9dc5de1311d8ab34cc7495470
SHA1 23fdcb7954539fd9965363441b4923ce4bdb13b5
SHA512 ffc776f32bcce263f42c4f33a17761167dbe8acce45117578fe53993d548e7013811a2192f7c6b9cd1d3fde94412a17d3608f7a846d38c26bcf22e1f0a455fb4
SSDEEP 98304:Miyfy3ljOeK3FDjYUhbx5g4HZP7v6HQIiS8Fj4yytIM+5VE:MiCeOeUFDj/15g45L6HQIl/IM+0
TLSH
T12EE64A07E86505E9C5AED534CA629223BF717C485B3023D72BA0F2643F76BE09EB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avdgttcy.exe

Path C:\Users\Admin\AppData\Local\Temp\avdgttcy.exe
Size 2.3MB
SHA256 4fa32a38c241987aeea4ac35654bec272007b635893669b8b156cb91b2af5306
MD5 df5839771fb7206fc8c54b87752c8f85
SHA1 be2f33ebec5abd0f4aaf57cce4f8e0d8f398887f
SHA512 e8eb9f037631b1b5e26b0347b485e46b1825853820f98adb14f1d3da6b0f75be7feca4398aa850c5ef2e8a651384b83fd95ee75f45e017280ed2a17936a3e914
SSDEEP 49152:l9sI30IOPHO0HKrNEXR2Z3Au/PJvTs69:jXaXRa/54
TLSH
T113B59E5AA3B801FDE0BBC274C9565A07D7B2B8061670D79F13D4479A2F23B716E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4f0b654-8ce7-4127-9646-7bdb170cf90f.tmp

Path C:\Users\Admin\AppData\Local\Temp\b4f0b654-8ce7-4127-9646-7bdb170cf90f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

da9n2wwf.exe

Path C:\Users\Admin\AppData\Local\Temp\da9n2wwf.exe
Size 529KB
SHA256 ce0d27a44176caf7e574ca69bb38d8f20880fb3f8a694c41696d24edcb7f4129
MD5 b8961dde0920a57932994bbc4131c161
SHA1 b49ccfeefcf25308e4dcf6cc6a4d942bf925688e
SHA512 1dc61eed0dd5a6e075e5b68f51eea20a1c41e46ed980130a094b9f82d7dabc4ba02fa671cc24f69c245fef1784059a7f25d751d962b7e20632b8d5feb539513b
SSDEEP 6144:NjLNrSV/lRyH3foOsYlf0lPcRbLG9qSB5Vh69yRyQllVP9TlMXmjCohgyAqjT4pZ:hL5w0HDsY1acR/EP6M5FuwCoZAsE
TLSH
T176B45B5AA29943FCE07BE07CD9475A42F639744703B18AEF039045772E572E2AF7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\dia_abe_240778609\Chrome\Default\cookies.json
Size 452B
SHA256 d4a80638177da1003e8073e2ac9a768aadc5ff45bb8f48fdd9b1fae2a6b64d76
MD5 551d1319a206c8e7e50a5b82b2a8b580
SHA1 bdd52332e596256dc21fc048380c35e5b2861a9b
SHA512 5672d5bfe42aa3fe7e8b6c01e1f9bac0634125108a044ea64d5cd26b3b36c5129ce83b7457ce75847319965ce34515bfd93fd9afc77d73cca982ccded73e91db
TLSH
T109F09EE9C0C55C325EA3DB306E007B6A72C42E376459BD84B2508C828055C89D1A14D9
MD5 SHA1 SHA512 TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-LP6P0DO3XT.tmp\_isetup\_isdecmp.dll
Size 31KB
SHA256 046dddc55633d3867ecf0c05d4ec7176ded1df0456a2aedcd1f50fb26e94c132
MD5 3d2871f010ab3c038c6df5df11245f86
SHA1 da9c39f9d86896edf50f58e12bb436e2133fa32b
SHA512 5d8f4f1ba245dabfce9dfc48897415cbb0b70e28191206dd2530be409b539d75df56cf3cb40f649e3e66ab5087596f1e3ea17f5467ea6e905de262253973bb35
SSDEEP 384:jxec1Jqzr9DeV6PDW3TMzZH3MKbizJ3KhKRPtAsLiAML/pwKNs6VozmOblvldeiZ:jiUV6PqQzZH4zN23AMA6QEAmbLn
TLSH
T177E26C46B9C02B5FD6C385B054CADF5E69B1E72223B4A9E790A068356F49FF32C1502F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ke28l4tm.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-TCEMC8JA40.tmp\ke28l4tm.tmp
Size 4.4MB
SHA256 ff0b740631c3ed5bdf660e26ca3174f0a28b94cac3c9eb07bcd636ed59635927
MD5 e2cd86805ddda170f7647c3136f14728
SHA1 afdd794307bfa5f79f685aaa4b1a330ba4ba9d9f
SHA512 3b27f469578ae1dc8f67f5faa4d023a6dfd0b2a9c73410ef0b54235c9531ca8fe5f906cc7f8d926ade566758394e07e956d88688bce5b30d01814a5b4244ef16
SSDEEP 49152:LoPNK2dE9FwYQ9gSlxcij31yGKTddr9ssOzNEbTWkBfJPb0lO5333qM:Lgw26xBij3QG+ddr9/OzGbRwm333N
TLSH
T131265C13B244E53AD4661A3B483BB648583B7F3D3A168C476BE4FD4C8E397406D2A787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ke28l4tm.exe

Path C:\Users\Admin\AppData\Local\Temp\ke28l4tm.exe
Size 12.9MB
SHA256 90ec1278f94f0df467d06aaf7459da70b5f2387199fd143313a1ef1c200aab5a
MD5 ee1dcda7210a0a4287402788a6e360fe
SHA1 f310f4be44676eda63e0c8c3fc4e69d5408f6f12
SHA512 3a1b6dc14968d67b59c5eb2edb95c0212e66e1f703b09255c7404d2c0d578ba9bd57010ca45654ef4107c08f25c827fb3d9edbe7db5be9daf440c7b878afa9d6
SSDEEP 98304:XAX7CeHAMxicqIC4O26tDZNypY8XvyOt3U04e253ak:OCbcqIm0VXLk0ixX
TLSH
T14FD61237B28AE53EE06E0A355A76B110543B7E2DAD138D0A96E4F45CCF353603E3B646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2148_331610088\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2148_97303045\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tjut3z34.exe

Path C:\Users\Admin\AppData\Local\Temp\tjut3z34.exe
Size 32KB
SHA256 532a1cbc310315498f9aae9b0c4e108fa00775b88cb35de7a395d4661ad32362
MD5 e15071f7629154d6c019747d58f6c6ba
SHA1 65e0f89c396bdec9ccb9ac477aedcb791926ff95
SHA512 c2213792195e0860035f58f99477b007ccb06d6833921cf5c2858ae610bc9151d8fe6b6f51754af21da7a764345e165d30ca925af711e9050584f38266f5261c
SSDEEP 768:F4lEO4nD74G3pPZFXq1+Z1Aqc0zsGTeks6o0W:FSx4nD0GLFngj0zBCp
TLSH
T1A6E26D13D347C577C53D873600A6A92AF9BB1A3031271DF3DBE894790E8C5906D2A9CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umo4n321.exe

Path C:\Users\Admin\AppData\Local\Temp\umo4n321.exe
Size 226KB
SHA256 4b20f08354cc3f000b49e7e104ed8c76720438bb6987e1e6eaef13cf9d359051
MD5 c0a26ad005c824abf68ff8145855301c
SHA1 35d1f0b442f0c2c66e82441b9e5de2ab32159423
SHA512 57c9862902ed72aa80909c4a6d864afb69ca2d2d650005f93b1883886caf7a88d5e754ff482e3a0be43692731b9431ff043045651da225fbd5e64da3a6a5899a
SSDEEP 3072:cu7oXKl1K+qYfq2p8/tPKEVVuoSA8TzIqOn4M0vyyGQ0MA8/Z/ho3oMqHqcKdP:/AKlYPYIPn/uJHJOn4MctZpXVKdP
TLSH
T1DF345B1A73A508FBE836823DC8931A06E772B4160761CFAF0764066A5F277D19D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xiynlr8m.exe

Path C:\Users\Admin\AppData\Local\Temp\xiynlr8m.exe
Size 620KB
SHA256 a668e0f7c669ad39bcf6ac0f2f367d0e39515786272084dc130fad1c88a5d59b
MD5 26b4b7cb8e2b55072a4d3e1e6fb7ef30
SHA1 5f33e27939ec29532a1f1b0875a5dd954cc8c7c2
SHA512 e4ae640f0e80617db7f9619c10d530bd2e52a18ac36085d647545f824557a5a3ec49e359f0ab713bb0e4bd02f0d03bb13a7a8dad691ffed75e613ac7fe40490f
SSDEEP 6144:73DQ73r/dI7LI+iix8/mRlR2InxCcMHSOX/revKmY+WCTNZil10lAJtxcGUvVocu:LDc7Mx8/ilR2IxCYo1T72vmcpXrr
TLSH
T1C5D47C56EBE502F8D17BC1B4CA829956EB77B815433065CB03E209675F3B6A05B3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y6i021w3.exe

Path C:\Users\Admin\AppData\Local\Temp\y6i021w3.exe
Size 160KB
SHA256 3fcd91299895aa6ec381aa4a94d6880ce22d9d41c897e020b3dd90372771b361
MD5 2895b3e51ba74818140efee2d1ce4cf7
SHA1 1d2209daddb33780811d9e4fb3a6d5010b67d656
SHA512 9f9fd92008ebac194973c69dd93702d42056e2fcb7182f31c4e589c190ed5a41c84aac3c60af248e04c1115f71aa47fde1136900a0ec36cb00031b4f98d6b915
SSDEEP 3072:CNX8oWfHMnSA1Lqq+jOWPN7SO3M6KSnvpH9Si:CNsoWfydLqxZ7FMWo
TLSH
T165F35A0BB3A524F9E1778239C8A51A06F772783217618BEF03A407765F632D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

z4qg5ib6.exe

Path C:\Users\Admin\AppData\Local\Temp\z4qg5ib6.exe
Size 35KB
SHA256 005e5918e86f5611806037ba97cffe63aa10b7b4a7a126a70bd20de296de0b6b
MD5 ee6884a21d50464d2d75e514fedd5b9c
SHA1 6988a696c95c36c3838feea9a49342d7825bef0d
SHA512 50dccfdc668c49eea7df8ce2a16119bc3b24632899a08be78fad0660e0e4607294e4e7c15be70d9f8e741c3302ba099f66bdb7a14101bdf56e5e08d9e7f51837
SSDEEP 768:8xW6V+7Vwu+mtYzYaBuE7MqeqUbhXh/8VysOxG+FYo:SBu+msqqXKl1fS+io
TLSH
T1C2F25C2D27A500F9E52B51B9CA81990AD37230164735E38F077487FB2F73AB2653E352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sptln.exe

Path C:\Users\Admin\AppData\Roaming\96ee85f7-624c-44ee-8e2a-f1319432aa7e\sptln.exe
Size 83KB
SHA256 6dad4e54d90db33dbdb43fed8e8f37cc1b2efb76c619b3ea08f560d0bda11ca6
MD5 c943699c000f1d0fdc81cb7ed5a109cc
SHA1 f69c92b0ce23baa24d74fb30a7cfed1168f44824
SHA512 59c0b4f076cdc4f1461ef23ebff2dabad941b71261b04d268a57cf22ada96b20826104b14ff9f7f003d913bf9c452e190a597f43a343df15fbc83a53a24b535b
SSDEEP 1536:DjrW7lTbC/m0/phiUfjeuE2uJPADGPVW9xiX7VzQx6d4yrqDV:frW7J0/phiUfjRutADJ9kX7V0x61rSV
TLSH
T1DB834975A3DE02F6D813CA38E9A4122BD371F041BE31570F4234DD1D2FA35A5BE58A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

276e659b-58ea-4662-b4fd-e899b822198d.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\276e659b-58ea-4662-b4fd-e899b822198d.tmp
Size 15KB
SHA256 b3027a59a0cb9df52fe2d3f73bbd50ebba0d75c73f9f3a13d6de24b4875f3c3f
MD5 c9964b5c978ce1d6b75b4f8fc76701e7
SHA1 d096c940c936c387b164ed91390239c0b8d2c30a
SHA512 c9d1b6ca6994139c48ba43c15525d65f9ef95adb2efb11bdc5ec7c3f6d76d1c936731fc6018adad7fc133f2158f1554008b0842419126fb7f0aa033f786fdac6
SSDEEP 384:C+OBqImmJvGBLx3NaFMJFpNBSJgDRiv+qVg6r3:HcvGtlNTwGqfL
TLSH
T19E72AE762CA56A272CF7C50ABA8E3B47CB646263C4D07BD4DCFC9F0E126B0481352956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d67e434-7d06-44dc-9a5a-93852741cf88.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\8d67e434-7d06-44dc-9a5a-93852741cf88.tmp
Size 2KB
SHA256 e71adf7a0bbe09e018fbb5083dce834a5abff73aa6cdd34723ecc0cf6dae2fdf
MD5 a6355f2b5599d49e741ab3c61eb28641
SHA1 adeff4f3f96914ba43aed365ac8fe0d19c9de650
SHA512 7f5b8770d55189b4b89f876959f46361d02aa4aaa6fccc47f3b2a3e7a8b8313626dcc367435c41ed797d0e6f6810e1a03350fd865b3a5c7161f5de9dd28696ce
TLSH
T1A1517433BD54AB3796A3D609B95B3F13DB3991B6AA916F5099ED0B1C01D321C1302C37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5f4d26d3183605f0f3da5c19dedd43a0a9ad43d8eb29f677191bf15f1b9b9198
MD5 b6dbb0d4579dd408cf358e5a3badc585
SHA1 5a0e153d48142c6b640ba27e2c4f90ff59468f96
SHA512 fa6ac24c4df945a4387290b61bce03973275d0c45dc7e26f729292e9101e277a9f85f6c3a28fee425c53fdb5d009b05ec617bf512b8c1f4c0211f42fb0b45f7e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ac7a5f1394745614cf22e7ba589a543311160e465e3961f19c26601cfb6aa74e
MD5 8511cc0a346c34b48e903df393110e19
SHA1 3b7804307172a7e47f9d8fb9c345ca52dd64f709
SHA512 9e282e8fad683da68432fb0085b3a8e58f910dd35f97e978e28ce91ee8291f61cd5667005affacb736517a41deb3d6203494a32a48dad97f31f0a0ba82487bcc
TLSH
T1ECD0125276110138C4103033004B61080440C50B40064182B46C855E9E045930E03841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

70b93d54-a389-42c3-b416-ef075e510d13.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\70b93d54-a389-42c3-b416-ef075e510d13.tmp
Size 6KB
SHA256 f0d0eb984564967beeead636ac91554f46e80cf1140e43527a7ee5ba98daabbb
MD5 e0c963a535b7d170dd4abc44ab24b64d
SHA1 2baba4fe4dc5be3b8f56efc3bea2cf610b58b51b
SHA512 73d04af524ab4f3762d8df54aca5893b8832c0e93eba79954fbcfb09895f69a98e19db5037297559d95d82dc797a703a806e60b2e8d0ae3f3c8dcb72c9616bf2
SSDEEP 96:stW/dC7cyGXb97kzo5h16Z5his7/x+6MhmuecS0Te1ejeXK+gyK0b28XM1C7K:stOAYfmoKYsV+F20TeQj1cbG6K
TLSH
T1A1D1A7025E68797B8CC6E519BA397B43E3F5607260D42E58EBFC492C15D76DC230390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 96B
SHA256 08afc0ae65bd2cf3285e9744b546bde22ca8efb263703dc561777aa1bebe0013
MD5 f50f88c1cd239455e40ebc6313de2e80
SHA1 b8d70971a700da59b0304bbfe4432f75866a9087
SHA512 6381b1d2e8829523f90236de5ce03cf46d4bb92c29ce1d0ff6cc3a59f96481a589ade4e71669be11a119babe8325f1f3216a267c0adac0b304f5e1ebb839291f
TLSH
T14DB002904259007BC354A7B4B4D356A072724C2ABA1F1A21B1E962BBED26785D737634
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 fe4de3f465fc1c0f6ab40cefd368d5a34d4771ff67c33774d11dfe16bbaad63a
MD5 2242a2ab6ba2b78e3da59a323c89ae81
SHA1 ea75297f88b429009ae68790908d94837db9f89c
SHA512 e2d08a059fc7c33218d074ee4c45b74180a5dd61b266d043683dd83ac0e7ee95bcae9f980cb625bb8dcdf921bac6601420734a6201edd22e845a750e12e75094
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c13d4478-a19e-4e38-9d41-8c3e4ee40139.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Network\c13d4478-a19e-4e38-9d41-8c3e4ee40139.tmp
Size 821B
SHA256 0b25a95647d7a04e30b832d43e9dffcdd2e8463a896c1784e0c295a5aeda72d6
MD5 88fd261057e4b16cb4519c022ff5871c
SHA1 c4f03e2d46109456a24a731d932c8766ddd4f4f3
SHA512 4f88c30f1f464353bb6b41144c0745986d26f59a7274584229219932633822fe01332b8698076b932a34bc81201bff7f68fd79e15529b709c54744664541abb9
TLSH
T1CB016FB6C7E4C57D484153E427243813CD2E151912282E67CDE6EBEAABE2475D71054F
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

c9a0d5cb-562d-4465-ad00-ecf84193d32f.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Default\c9a0d5cb-562d-4465-ad00-ecf84193d32f.tmp
Size 6KB
SHA256 952c71d8be3ab60fd22bcfa00f67c149a2cf5044b00739246413c81f8d1f4d1d
MD5 ec8d1fe60576ef9c2ec86481b74004bd
SHA1 806180f8fbeba868d0329bb41127fc62851705b2
SHA512 576edc48d9d6b14c8f8edfc162db7f703f68a757e3e0d090a0ec92741fa5d5aaf72229d90bb24513335a98203dceb897e41565b2f5466565aaa950427e290173
SSDEEP 96:stW/dC7czXb97kzo5h16Z5his7/x+6MhmuecS0Te1ejeXK+gXKnb28XM1C7K:stOAYtmoKYsV+F20TeQj1wbG6K
TLSH
T16BD1B6025E68797B4CC6E119BA39BA42E3F5607270D52E58EBFC462C15D76DC2303C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\Local State
Size 1KB
SHA256 02e17c6fb3df5e9ae918232f426705547e2f44db1fc0b52dc5fd40f13133f2f7
MD5 fa5936355d222f3450bbf3870cdf6365
SHA1 48abbc75a1e00fb6de2fce45bbbf375e31284b6d
SHA512 9e0b7f9b1c727d9b31970053cdb029f6ee57fcd5fe69102e5ed8f8c2ca724683252a290cbcb24d401db033cf9e646f0b82c8c50bb1051081d51a60759cd4dd20
TLSH
T130216572E9E45B32A942A25B21573E43AF25607B92908F0064ED8F6C12E314C5726D33
MD5 SHA1 SHA512 TLSH

Submit Download

a216d386-9367-478f-a186-4eac542c65e5.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\a216d386-9367-478f-a186-4eac542c65e5.tmp
Size 3KB
SHA256 b3fe99c468d60501924e8b2317c45d04ff9dbb7dd51bbc2bdaf657e4b265299d
MD5 18dafce0ac0d806c3516e14594857df3
SHA1 5cec9a892096757067be77669e4a80da331bae27
SHA512 892f3e19f7f3d5fc4afe5a4d1a1e0b4647dd558c451242e1ae5522d502454c285af707d6a958a72144307e827260de40511f64366e42250a734f107688edd5ab
TLSH
T117618636A9B4AA3B4AA3DA05B8873F06A7A55137E5D17F54D9EC0F1C01D325C1342D23
MD5 SHA1 SHA512 TLSH

Submit Download

e1ca913a-8ca3-457a-9459-30c3c7fbf007.tmp

Path C:\Users\Admin\AppData\Roaming\SuperCookies_patched_NATIVE.exe\EBWebView\e1ca913a-8ca3-457a-9459-30c3c7fbf007.tmp
Size 15KB
SHA256 e6d46e4c408d008dd37b936675daac09ba25e9b017fce9dd39426b2ad064b8b1
MD5 fd44c5e651156844f23aaeee3112c63f
SHA1 bbe9e3681d2dedf31d2cb945aba8cfd4df95689b
SHA512 460d6c16bfe45955b385f51194ac07db3c2518c0def2f7cd8f643e9f5c7637f39d24335cfe0d41af4e4477e5faead9765c5450fca88df3b90359eb196006c0d6
SSDEEP 384:z+OBqImmJvGBLx3NaFMJFNNBSJgDViv+qVg6r3:KcvGtlNPsGqfL
TLSH
T17572AF772CA55A272CE7C50ABA8E3B47CB656263C4D0BBE4DCFC9F0E126B0481352956
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

synchost.exe

Path C:\Users\Admin\AppData\Roaming\synchost.exe
Size 526KB
SHA256 5dc3ef3862dda1c7f3d289f52cffcd13f182dc393ca6b71fc6bcd95f7e8e9845
MD5 b5efb0e380735de832f10d767f0a165c
SHA1 66e02c27539e98132c2c4dcc3075f4ee56fee1c7
SHA512 d75a5c8852e8d66d78377a31cafcb054ac3e4faf8fff2d78c51771cdb0148140e45032fa9e8081f5247c4315e9c3fe34bddfd955c12fe96cdea5dda39e799a3d
SSDEEP 6144:jLNrSV/lRyH3foOsYlf0lPcRbLG9qSB5Vh69yRyQllVP9TlMXmjCohgyAqjT4pZ:jL5w0HDsY1acR/EP6M5FuwCoZAsE
TLSH
T19DB44B5AA29943FCE07BE07CD9475A42F639744703B18AEF039045B72E572E1AF7A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_106152412\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2840_118452919\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/1332-903-0x0000000000E90000-0x0000000000FA3000-memory.dmp

Download

memory/1332-62-0x0000000000E90000-0x0000000000FA3000-memory.dmp

Download

memory/1332-344-0x0000000000E90000-0x0000000000FA3000-memory.dmp

Download

memory/2020-1038-0x00000261B2650000-0x00000261B2651000-memory.dmp

Download

memory/2020-1033-0x00000261B2650000-0x00000261B2651000-memory.dmp

Download

memory/2020-1031-0x00000261B2650000-0x00000261B2651000-memory.dmp

Download

memory/2020-1040-0x00000261B2650000-0x00000261B2651000-memory.dmp

Download

memory/2020-1042-0x00000261B2650000-0x00000261B2651000-memory.dmp

Download

memory/2020-1041-0x00000261B2650000-0x00000261B2651000-memory.dmp

Download

memory/2020-1039-0x00000261B2650000-0x00000261B2651000-memory.dmp

Download

memory/2020-1037-0x00000261B2650000-0x00000261B2651000-memory.dmp

Download

memory/3772-198-0x00007FFF8C450000-0x00007FFF8C451000-memory.dmp

Download

memory/3984-66-0x0000000004F10000-0x0000000004F35000-memory.dmp

Download

memory/3984-54-0x0000000003790000-0x0000000003791000-memory.dmp

Download

memory/3984-25-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/3984-52-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3984-53-0x0000000003780000-0x0000000003781000-memory.dmp

Download

memory/3984-383-0x0000000003700000-0x0000000003701000-memory.dmp

Download

memory/3984-68-0x0000000004F10000-0x0000000004F35000-memory.dmp

Download

memory/3984-65-0x00000000037B0000-0x00000000037D1000-memory.dmp

Download

memory/4408-21-0x00000235C1CB0000-0x00000235C1CB2000-memory.dmp

Download

memory/4620-761-0x0000000000DB0000-0x0000000001221000-memory.dmp

Download

memory/4620-796-0x0000000000DB0000-0x0000000001221000-memory.dmp

Download

memory/4620-902-0x0000000000DB0000-0x0000000001221000-memory.dmp

Download

memory/4620-384-0x0000000000DB0000-0x0000000001221000-memory.dmp

Download

memory/5272-11-0x0000020F29230000-0x0000020F29231000-memory.dmp

Download

memory/5272-10-0x0000020F29220000-0x0000020F29221000-memory.dmp

Download

memory/5272-9-0x0000020F29210000-0x0000020F29211000-memory.dmp

Download

memory/5272-13-0x0000020F29260000-0x0000020F29261000-memory.dmp

Download

memory/5272-12-0x0000020F29250000-0x0000020F29251000-memory.dmp

Download

memory/5612-973-0x00007FFF8C580000-0x00007FFF8C581000-memory.dmp

Download

memory/5612-972-0x00007FFF8DD00000-0x00007FFF8DD01000-memory.dmp

Download

memory/5840-721-0x000001EDC1A90000-0x000001EDC1B04000-memory.dmp

Download

memory/5840-226-0x00007FFF8C450000-0x00007FFF8C451000-memory.dmp

Download