e52e391e897a361f379ed631c1e7f7bf1ae866d0da171cdb27a1e642eee9d8e5

Analysis

user interaction
yes
max time kernel
130s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BakkesModSetup.exe
Size 10.4MB
Sample261024-vy6nlsfd56
SHA256 e52e391e897a361f379ed631c1e7f7bf1ae866d0da171cdb27a1e642eee9d8e5
MD5 ac00e33cfb8c79366723713fcec08d6b
SHA1 c928935cb323328c4fc4f03c422b1292d79dea52
SHA512 8b5a7c1b4a373ff7a57ce688e367f39ebb0e9322dc5c16f603b1e8089b2d6d465defda059f4f89495932fb943fad96af67be133fb47f4c4f6b7af714aa954f7c
SSDEEP 196608:A0q0aXyxj+YAz4tmF7VEFmbUubmwHdWWPlMEbyKdSzcyAv5XnNFG:A6sPUWEFmbDN/1eQSzIs
TLSH
T119B6233FB258A53EC56A4A3149B3D320497B7FA1B81A8C1E43F0395DDF364601E3BA56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4328	BakkesModSetup.tmp
1604	BakkesModSetup.tmp
5940	BakkesMod.exe
5224	BakkesMod.exe

Loads dropped DLL 4 IoCs

pid	Process
4328	BakkesModSetup.tmp
4328	BakkesModSetup.tmp
1604	BakkesModSetup.tmp
1604	BakkesModSetup.tmp

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BakkesMod = "-"	BakkesMod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BakkesMod = "\"C:\\Program Files\\BakkesMod\\BakkesMod.exe\""	BakkesMod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BakkesMod = "-"	BakkesMod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BakkesMod = "\"C:\\Program Files\\BakkesMod\\BakkesMod.exe\""	BakkesMod.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\BakkesMod\unins000.dat	BakkesModSetup.tmp
File opened for modification	C:\Program Files\BakkesMod\BakkesMod.exe	BakkesModSetup.tmp
File created	C:\Program Files\BakkesMod\unins000.dat	BakkesModSetup.tmp
File created	C:\Program Files\BakkesMod\is-E3INR.tmp	BakkesModSetup.tmp
File created	C:\Program Files\BakkesMod\is-K4H8J.tmp	BakkesModSetup.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BakkesMod.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BakkesMod.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	BakkesMod.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	BakkesMod.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BakkesModSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BakkesModSetup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BakkesModSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BakkesModSetup.tmp

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2268	chrome.exe
5180	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 5 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2964-0-0x0000000000400000-0x00000000004F3000-memory.dmp	innosetup
behavioral1/memory/2964-13-0x0000000000400000-0x00000000004F3000-memory.dmp	innosetup
behavioral1/memory/3028-223-0x0000000000400000-0x00000000004F3000-memory.dmp	innosetup
behavioral1/memory/3028-257-0x0000000000400000-0x00000000004F3000-memory.dmp	innosetup
behavioral1/memory/3028-390-0x0000000000400000-0x00000000004F3000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2392	taskkill.exe
1384	taskkill.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{30F80F98-7820-44A5-B1B7-FFC12DCE33A2}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{37B010C8-FE1A-4FA0-83C9-AFAE3C3C2F41}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5940	BakkesMod.exe
5224	BakkesMod.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
740	chrome.exe
740	chrome.exe
1604	BakkesModSetup.tmp
1604	BakkesModSetup.tmp
5940	BakkesMod.exe
5940	BakkesMod.exe
5940	BakkesMod.exe
5940	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
740	chrome.exe
740	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5224	BakkesMod.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	1384	taskkill.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe
Token: SeShutdownPrivilege	740	chrome.exe
Token: SeCreatePagefilePrivilege	740	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
1604	BakkesModSetup.tmp
2156	msedge.exe
2156	msedge.exe
5940	BakkesMod.exe
5940	BakkesMod.exe
5940	BakkesMod.exe
5940	BakkesMod.exe
5940	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
740	chrome.exe
5940	BakkesMod.exe
5940	BakkesMod.exe
5940	BakkesMod.exe
5940	BakkesMod.exe
5940	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
5224	BakkesMod.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe
2156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4328	2964	BakkesModSetup.exe	85
PID 740 wrote to memory of 4884	740	chrome.exe	97
PID 740 wrote to memory of 1900	740	chrome.exe	98
PID 740 wrote to memory of 1900	740	chrome.exe	98
PID 740 wrote to memory of 2268	740	chrome.exe	99
PID 740 wrote to memory of 2984	740	chrome.exe	100
PID 740 wrote to memory of 2984	740	chrome.exe	100
PID 740 wrote to memory of 4560	740	chrome.exe	102
PID 740 wrote to memory of 2688	740	chrome.exe	103
PID 740 wrote to memory of 4560	740	chrome.exe	102
PID 740 wrote to memory of 2688	740	chrome.exe	103
PID 740 wrote to memory of 1728	740	chrome.exe	104
PID 740 wrote to memory of 1728	740	chrome.exe	104
PID 740 wrote to memory of 1104	740	chrome.exe	105
PID 740 wrote to memory of 1104	740	chrome.exe	105
PID 740 wrote to memory of 4628	740	chrome.exe	106
PID 740 wrote to memory of 4628	740	chrome.exe	106
PID 740 wrote to memory of 4148	740	chrome.exe	108
PID 740 wrote to memory of 4148	740	chrome.exe	108
PID 740 wrote to memory of 4304	740	chrome.exe	109
PID 740 wrote to memory of 3424	740	chrome.exe	112
PID 740 wrote to memory of 3424	740	chrome.exe	112
PID 740 wrote to memory of 3100	740	chrome.exe	115
PID 740 wrote to memory of 3124	740	chrome.exe	114
PID 740 wrote to memory of 3100	740	chrome.exe	115
PID 740 wrote to memory of 1400	740	chrome.exe	116
PID 740 wrote to memory of 1400	740	chrome.exe	116
PID 740 wrote to memory of 5092	740	chrome.exe	117
PID 3028 wrote to memory of 1604	3028	BakkesModSetup.exe	119
PID 1604 wrote to memory of 2392	1604	BakkesModSetup.tmp	120
PID 1604 wrote to memory of 1384	1604	BakkesModSetup.tmp	122
PID 740 wrote to memory of 3408	740	chrome.exe	124
PID 740 wrote to memory of 4988	740	chrome.exe	125
PID 740 wrote to memory of 2124	740	chrome.exe	126
PID 1604 wrote to memory of 5036	1604	BakkesModSetup.tmp	128
PID 5036 wrote to memory of 2156	5036	msedge.exe	129
PID 2156 wrote to memory of 3584	2156	msedge.exe	130
PID 2156 wrote to memory of 5180	2156	msedge.exe	131
PID 2156 wrote to memory of 5188	2156	msedge.exe	132
PID 2156 wrote to memory of 5196	2156	msedge.exe	133
PID 2156 wrote to memory of 5188	2156	msedge.exe	132
PID 2156 wrote to memory of 5188	2156	msedge.exe	132
PID 2156 wrote to memory of 5196	2156	msedge.exe	133
PID 2156 wrote to memory of 5276	2156	msedge.exe	134
PID 2156 wrote to memory of 5276	2156	msedge.exe	134
PID 2156 wrote to memory of 5276	2156	msedge.exe	134
PID 2156 wrote to memory of 5288	2156	msedge.exe	135
PID 2156 wrote to memory of 5288	2156	msedge.exe	135
PID 2156 wrote to memory of 5288	2156	msedge.exe	135
PID 2156 wrote to memory of 5436	2156	msedge.exe	137
PID 2156 wrote to memory of 5444	2156	msedge.exe	138
PID 2156 wrote to memory of 5436	2156	msedge.exe	137
PID 2156 wrote to memory of 5436	2156	msedge.exe	137
PID 2156 wrote to memory of 5444	2156	msedge.exe	138
PID 2156 wrote to memory of 5444	2156	msedge.exe	138
PID 2156 wrote to memory of 5772	2156	msedge.exe	141
PID 2156 wrote to memory of 5772	2156	msedge.exe	141
PID 2156 wrote to memory of 5852	2156	msedge.exe	142
PID 2156 wrote to memory of 5852	2156	msedge.exe	142
PID 1604 wrote to memory of 5940	1604	BakkesModSetup.tmp	143
PID 2156 wrote to memory of 5332	2156	msedge.exe	145
PID 2156 wrote to memory of 5580	2156	msedge.exe	146
PID 2156 wrote to memory of 5332	2156	msedge.exe	145
PID 2156 wrote to memory of 5580	2156	msedge.exe	146

C:\Users\Admin\AppData\Local\Temp\BakkesModSetup.exe
"C:\Users\Admin\AppData\Local\Temp\BakkesModSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\is-IBE9V.tmp\BakkesModSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IBE9V.tmp\BakkesModSetup.tmp" /SL5="$5027A,9981608,941056,C:\Users\Admin\AppData\Local\Temp\BakkesModSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffea2bec728,0x7ffea2bec734,0x7ffea2bec740
  2⤵
  PID:4884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,13362497622615558693,17957365331408548603,262144 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,4375864168003091725,8730088422015700090,524288 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2440,i,18392057319751878741,4928637675118854685,524288 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2344 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,16505554243353012500,14583095320394224252,2097152 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3452,i,7833377009718270735,18175635589942505746,2097152 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,9632508115128438777,3442420947058762973,2097152 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4540 /prefetch:2
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,2009257113254806135,4456422251716534384,2097152 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4944,i,7504544531065510004,8468455872267201350,2097152 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5692,i,13541672609648643605,4117351157755589992,2097152 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,4009930672973092389,14240087549845404938,524288 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5876,i,9042399186189291056,5803374642897971373,2097152 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,15602486117058235406,2977870616860218622,524288 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,2198846917058618512,17120737463864852125,524288 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6192,i,11730737529893930700,14046366217263902610,2097152 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,12207228833189858299,7796810831463533440,524288 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6584,i,8821273679876444154,17005949552317906903,524288 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4892 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3700,i,13739224507350272538,4572214749147052965,524288 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6512,i,10431773401752492789,16501638034759161555,524288 --field-trial-handle=1988,i,4266707306900155807,5805345208864687591,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:2124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:880

C:\Users\Admin\AppData\Local\Temp\Temp1_BakkesModSetup.zip\BakkesModSetup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_BakkesModSetup.zip\BakkesModSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\is-KR5PK.tmp\BakkesModSetup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KR5PK.tmp\BakkesModSetup.tmp" /SL5="$20216,9981608,941056,C:\Users\Admin\AppData\Local\Temp\Temp1_BakkesModSetup.zip\BakkesModSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /f /im "RocketLeague.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2392
- - C:\Windows\system32\taskkill.exe
    "taskkill.exe" /f /im "BakkesMod.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.google.com/spreadsheets/d/e/2PACX-1vSLd3OucDGczgvFDa_D4I72MYNVhskJMe-pA8Bi5eFBuCADixLR1QleIE-X8eE_4L-AlLNhIm6A7fTK/pubhtml
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://docs.google.com/spreadsheets/d/e/2PACX-1vSLd3OucDGczgvFDa_D4I72MYNVhskJMe-pA8Bi5eFBuCADixLR1QleIE-X8eE_4L-AlLNhIm6A7fTK/pubhtml
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffe98e2c188,0x7ffe98e2c194,0x7ffe98e2c1a0
        5⤵
        
        PID:3584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,5278459214268104611,476794986292782061,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,5775493584811993548,9267047122622050264,262144 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:2
        5⤵
        
        PID:5188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,2341764987657532525,10818063377940921132,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
        5⤵
        
        PID:5196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,8647549362872382271,16141519329822350945,2097152 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        5⤵
        
        PID:5276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,17828491922424236356,4278860836837678509,2097152 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
        5⤵
        
        PID:5288
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,15867247133857344794,12456295940476129352,2097152 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
        5⤵
        
        PID:5436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,11236628526371738516,1999795300276925209,2097152 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
        5⤵
        
        PID:5444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,10234464472556505385,9735896024442448138,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
        5⤵
        
        PID:5772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,11290117951089579956,11191669741349425372,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
        5⤵
        
        PID:5852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,17237884514713158437,9749642889177855521,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
        5⤵
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,6245624307395014018,11884404776671983008,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3907016502246233564,13209826228147397523,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
        5⤵
        
        PID:5588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14673185870973459114,8441094736869324540,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
        5⤵
        
        PID:5884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13419605896532137281,12435809195602221868,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
        5⤵
        
        PID:5172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3907016502246233564,13209826228147397523,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
        5⤵
        
        PID:5452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,17478850615750508940,4639944862347742523,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
        5⤵
        
        PID:4612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,5050484114533918565,11441232420222711194,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
        5⤵
        
        PID:5232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,9526637817668500737,4928512496000495726,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
        5⤵
        
        PID:6568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,890829696465684772,2611291059742215282,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
        5⤵
        
        PID:4368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,17389631831897885390,13986371977441762545,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
        5⤵
        
        PID:6012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,11059108224295863689,16533961208981530217,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
        5⤵
        
        PID:6672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,123898709863989617,3384466911803101864,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
        5⤵
        
        PID:6844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,12839368965200872078,11377950135784763564,524288 --field-trial-handle=2948,i,14341942591346590287,7250797029189867834,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
        5⤵
        
        PID:6936
- - C:\Program Files\BakkesMod\BakkesMod.exe
    "C:\Program Files\BakkesMod\BakkesMod.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5328

C:\Program Files\BakkesMod\BakkesMod.exe
"C:\Program Files\BakkesMod\BakkesMod.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BakkesMod.exe

Path C:\Program Files\BakkesMod\BakkesMod.exe
Size 21.0MB
SHA256 7be05327dad2d1d14c7044a2f0fb3ff5eaa189b22ab7e7180c4d4dca69905955
MD5 c34f490cccb725c54ed68117d98b0f9c
SHA1 dda6996d217518f9a0ae8b983cd5a14c74ed8cb2
SHA512 7b9999afbab2becdeab77c5cadd113da101b3bc80bc613d36ec183ac17f7f537a515e3130524334c4c1bb018be26bde517b22784098934034651939a0c0dcb5f
SSDEEP 393216:8bBbl2gEEw2hct9wT49UkZE8U8e+YKauBL0MOfy/T6Jsv6tWKFdu9CXT+Ks0Y:802CPPT4rs0
TLSH
T1BD27AE9AB2A501D8D47BC038C7979227E7B17856177067CF16A4ABA91F37AE01E3F310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BakkesMod.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BakkesMod.lnk
Size 884B
SHA256 39f7d357922f8b7705d825dada0ed55fb3e29b07de37112a2ae8a9fee40fbb79
MD5 4f38b587f3f49731c46dca7f799484c7
SHA1 f1572006036cb19f3bc78467d53f2f7441f0de37
SHA512 3311cbffc35e53e67ead8607aa3a9ed31e0af9acd6bbee7fa9b17ae27fc426dd86ce4a91289377e448d1de91b35e4564d00676c1f5eae6da4ba2c68cade09986
TLSH
T19211401006E32BD5E2F349B657F117324777F905DB05072E609D42801DE41859A3CF66
MD5 SHA1 SHA512 TLSH

Submit Download

56ce70a6-b62c-4c08-952d-b458f95de933.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\56ce70a6-b62c-4c08-952d-b458f95de933.tmp
Size 130KB
SHA256 a3f67cb56799457ee16941f3c154e638ae08a6c8eed3bf8503d9441f4f855dba
MD5 1b7da41bd3081dc996e86bc24436f693
SHA1 4b6f066d0eefa3cd9dcd487f71c398f69bb2083e
SHA512 85c364702ee54b186906c22bf482c37e29245d50a897eec757ebb43df4ea6ea79d8524343b3dad8613174ade77134997ab860704ea818cad2044814ab45f12ff
SSDEEP 3072:I+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:I+hFD+7t56OD9ZfSAppry
TLSH
T1E5D31233AA51D8BBC9BC6541B157A304DE666CED41EE7A09444A5F8EE09FC4C07B3A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cfeecc2-c7ae-43bb-a145-36276fd928df.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6cfeecc2-c7ae-43bb-a145-36276fd928df.tmp
Size 269KB
SHA256 3ca07c82c7cb06cf418d7d5efce2f9ad588bb2242bf36697b2c37b38fbcf0d34
MD5 0707df6286be428186806e04c998cf4e
SHA1 de5092f54447ce8e8063fdcf161033be3326d550
SHA512 4c11a345bfaeb6e26082494e361e8dd812175e58c433aa141a8cfdcf9c5b2295fe8ca25d08ee1b1c0f162abeb5efad2d1947ed973a0df62b1bb9536ead5ea040
SSDEEP 6144:lHCsUfw5u7eC94LUX4rY7Q/C0+hFD+7t56OD9ZfSAppr8/:8s2w5Ee5Hra0yFSXD9ZfS4+/
TLSH
T1674423F1DF6A186B1EFC4606B21773084F7ADDE599CC2549808B6E4B309EB990263727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e8e4bb5-9023-41f7-bb47-2e13b670b386.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8e8e4bb5-9023-41f7-bb47-2e13b670b386.tmp
Size 270KB
SHA256 01fa407cb4c6ffefdb1ed3c5da9a93fe0f88216bbf91df118f0b2a892fec820c
MD5 55067a120d96ad450d0a63974eb549a5
SHA1 54034a9e8e74e46b8754211db328c098c3b3f0b7
SHA512 049af1b681f1e73498c8ada8ff20c13bb107e7f577ce5d99b88f5c61a2cf6652e8eea72afa1e3e5ed158e2779a48d250c570fbf9d6cabaf9f6811863fe4f28ca
SSDEEP 6144:0fHCsUfw5u7eC94LUX4rY7Q/C0+hFD+7t56OD9ZfSAppr8/:rs2w5Ee5Hra0yFSXD9ZfS4+/
TLSH
T1314423F2DF2A186B1EFC4906B11733084F7AEDE6D98C154D804A7E4B309FB994667623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a3646ba-7645-4928-b7b8-90facb9679d9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2a3646ba-7645-4928-b7b8-90facb9679d9.tmp
Size 13KB
SHA256 916a3ae266af119d47e4aeb21112885669de813301681a1869471dd46cfdc4a4
MD5 298498f932037d6e7fa1953674b62594
SHA1 42621e047be29b0f51049dfb3e94d055f1f11942
SHA512 c4f5ea79c7198b38afcfb7414d98aa9b941653ce85e5289664ba50d052c4299fe810fb98ae00eb9d563312267636b97a7345f445f21acf541c528f4af75ef3eb
SSDEEP 192:SRSZcBz/FLOJWtsY6Ev700spAPRp2kSLC9+Hsb+WN6/n884yw2h1eqVdVyIsnAU/:SRSZmz/SbgojUXLUwOq2/h8
TLSH
T13952C52AAD10697F5CEBD21AF962775BE7F6202530C52E80EAFC893C24D79DD211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52a2889c-bf7a-4b9f-b484-45731d1df832.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\52a2889c-bf7a-4b9f-b484-45731d1df832.tmp
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90411d67-0d6c-4ec1-b8f3-e289c81aeb90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\90411d67-0d6c-4ec1-b8f3-e289c81aeb90.tmp
Size 414B
SHA256 ff355deccf4759e8cef9aa4e164049112d0a346d451bf820932f380bfc4b5055
MD5 8123e577c1a32aff30eb9d0d1361d67c
SHA1 a5df0cc0626f6fa0cab715d15cb67373d524eaa8
SHA512 6dadb9250a3b8dab9bbf6db6a13c9adc225c51f25d3f55b9cab32b4d57e9e1baa2b808beafd4f30286795e2bdb1b3f3253bac7414a1100d6caafb5f2c8d5fb51
TLSH
T1FCE022E9CC20EC3B28FD872A90540746E74013572681890F3A3CA11C8FF177B49969AC
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 672B
SHA256 c8f94897c0b52b1ba8ca56dcfd98bd33ea29b5c76ddf28aef22538a7a7e1c396
MD5 090c5615a0855b9a2647f88acd0628b4
SHA1 f609eae2aef3a886c24e0af565e2787afddbd21c
SHA512 b673fc3ff95b762ca447648d940df053ee5a688af6dc550589205f6cac3170b8364742266bf25574dbcf6942d1391433be9cb4d4d5eb86a924c36e491fa8fabf
TLSH
T1CA019701E6C7F489DBC2897C3AAA011631200A5BC5CF353240F8123D539E3B9B8520F9
MD5 SHA1 SHA512 TLSH

Submit Download

0b83f560-be9c-42e5-89ac-93c3cbf3550c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0b83f560-be9c-42e5-89ac-93c3cbf3550c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f4718450-9a21-4f1d-9ede-87f083cb459e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\f4718450-9a21-4f1d-9ede-87f083cb459e.tmp
Size 8KB
SHA256 992e1cdd379625b49cc5737f1cc0615bee6d45cc0e25492820ba1e19415ad98d
MD5 270c5303727fe39d6887da370c59f303
SHA1 b03067f521e78c81141b9dbbcc4911fab128dff5
SHA512 d8a88ad57d6749474ad6e3200d178573bc536fc4f413e5fbb6f17d93f2b85a41356edd12114765db8296c71e86b830e703ba2bc04a22fddc065287e3d5a7b343
SSDEEP 192:D3YqxcRvreBWaabVZoECEu4m4cfT6wkGr82KJvF7mtBf1K:D3YqxcRvreBWaabVZoECEu4m4cfT6wkx
TLSH
T13C02C0F7C3D8CA6D880556F5A7257F1FCE2D0A18432C3C2689D8AE4BD3E2472D24169E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 745cf16905de9ba003c536e0f8ecb01a1dcd591ef7d41c8657912d9e1148eeb5
MD5 f4a9605696606e76fb7e3e06cc57531a
SHA1 fc3676694986dd5bd4dc73ded3cc166848b920f6
SHA512 2980cb6edfe145827b289a3392929976cf7dbffca6a826c7a8c027f8954b34a5071ca3e9889dd4ff3203a74fac17d7e28f966a231905c0f18118b4e0f9a29c9f
TLSH
T12CB0120690422701C00103F01791905876608F34D11213A942E10D198835150806731D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 574a872abcf7cec3c514de12c6744b35237093756e679ef81b282bf67c3f48db
MD5 dcc0351c033889a0d458c61cd7db8d4e
SHA1 18d69351dc7223d5c168dbebf0b0d7ae917457c7
SHA512 616cb814fbde9884600d5321416b6f43662f4075d54558a60cd660f90b266ca74fcf4738866c32d696ad6c7b7304e6b3b105e7141a2072ebd224fb601953a4ab
TLSH
T144B00255C3126A12C14307B4399599DCB164FF25D703222A92F05E7ADC2E6644626971
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 ef96a4c11980311e6215400314f3fb77b501dcf0da6db377d7b1078ea96cc74d
MD5 e8ed66912c7f6aecba0a04053ba290c9
SHA1 4cb422745d6549cae0d65e5a8468e9b0dcb55ec0
SHA512 e7912de60794c546cc478dd6188312ed5def93684477154d998c712f9c5a9244855386b05cdb5c048ffab53680987a05e34e049f83f072f41f47eae1b2cb9eff
TLSH
T121B0124C85804802DA4182B11AC410D432303D0413034419C2A011359E159028100100
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\744f5f1a-2587-4a00-af3d-26326bd92d07\index-dir\temp-index
Size 72B
SHA256 08d25f02f69c7a42012736452eff90b0f70561a5bf89b82df9668e1c873fbaf8
MD5 6fff5fb49af4f1a309f324173338564a
SHA1 ec62083a72081b87bf638ab65563cf5a48879426
SHA512 d6d7a47a859b57f7d9f9e227e74279dc2ea42ee119ffebbab0ed540791072e8b1e4ebbeeef0a9142dfc691c904503d53f3fe9e3571255f0f1a56e346c0668137
TLSH
T1BAA0026941500602C40402B4245701763272DDE0ED06535B91D02598D8D51955283338
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\744f5f1a-2587-4a00-af3d-26326bd92d07\index-dir\the-real-index
Size 48B
SHA256 b2d86c2fef12415a3b46b2daf36a0acf1e9883c51315603b23397c5a52e43a8d
MD5 782350726bc64e83b863d740f4b61f01
SHA1 bc8d5755dc227fa10f003b0c013b49f616ff0513
SHA512 2318b74c4095ab15c279ba80bf515c3a14a3330d8aea3ee8b1bd43ce109eefe9075b8136550cf579bff8556bcebe31bd32a5bb34077a82ecb44d066a0c7158fd
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 163B
SHA256 a95e15069c4faacb0dffcaa803bd44a375f178b7d4f51531fe0833489d4a5ab3
MD5 1a6e617afa8a6ab252700489fef70c0f
SHA1 4c93bd20615d4027029df4176bae98f87f1aed79
SHA512 8dd0160fd5d442f5dcfc4bcb49e6c4513d340fbf6d3a6e5c4735b095bb5e136aaab5012c438c8806cb9506838164d0863fe33b242da09e1045c33330c4e7e3db
TLSH
T1FBC08CA7953181862F2094DA603832ACC202AD8CDCC8CCE98442F0997678623A041624
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 154B
SHA256 0ee0db870e453d9e778895710f6bd27569d2721ecb2696c623eeda2e9209fb4c
MD5 4aff63bfd6226ec3c342f88747d9a8d5
SHA1 0a828daf40f0b6582c21e99e5aef518fc32161c9
SHA512 dfa5a53eef743b4c6b4f23f27d9ec39dfe58c58d7447dd735c186668b79f52f0841180f47f4c4b625b4bdd1f261c46e9c58b27800968a9713b77dac98e237297
TLSH
T172C08CE30821858A5F34A6CB6028B21DE14B821C8CD8CCE1D00470423078B27C802A28
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 79B
SHA256 f89da2de5eb67d2041103128e05f8e8ef32e37dea5befa05567fe6e217594a42
MD5 7911b273025c5dc2ef1a93753323e302
SHA1 f94c4e254ed4444820c939f47c6365ab36da149e
SHA512 4120a63b0b5dc91fc4caf878467e1d9d1a76a08a02a36291ad293ba0376cc9d337e20319b5f5867a3b4e7840409a96650a14753b8fc8ef180afc35ad2ac8f5d9
TLSH
T17EA002F70865849E5F34A8EF2238B76DE14BA28CCDD4CDF2C419D5963138B7B1042924
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 160B
SHA256 df00af5a8e0ea34841c3364fa9b3c76a5eb0a94250ef0e2135b25370d89db5e2
MD5 1ec36897275d78cd59a68a5ec67ff288
SHA1 e3f8cbe42881f2ec2191110921a161f2645de273
SHA512 43a98982f68120f3e21865c9ff93f507c73115710c67d4cb8de5eb61aa06f0b47024df349156296b82eb3bd91861e243de8cef9c144c111628274678ef614ae3
TLSH
T19DC08CE30831454A5B3466C76138B20DE15B8E2C8CC8CCE1D00670423038B27C805928
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

acab774d-9624-4ea4-8378-ca5442934b63.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\acab774d-9624-4ea4-8378-ca5442934b63.tmp
Size 13KB
SHA256 bd982cb4468e4d63eac34e4680d9bfc303274aff3df102ca8e13002c0df35abc
MD5 da90e4649d04329e29c5ba132c8c8b2a
SHA1 ebc81be9a74f0c2425130f5fd9e338e2288797f0
SHA512 a5be0b8fd12e46bcbee52a58561eabddaf5323d7604a29bc85dd35766cb41ef2fbf4a832b2b26e31f743f2c0161f6dcc515aaa366b60674ed98d6089d00ade0d
SSDEEP 192:SRSZcBzbFLOJWtsY6Ev700spAPRp2kSLC9+Hsb+WN6/n884yw2h1eqVdVyIsnAU/:SRSZmzbSbgojUXLUwOq2/h8
TLSH
T11752C529AD20697F5CEBD21AF962775BE7F6202530C52E80EAFC893C24D79DD211701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6abdaf3-35a4-436e-804c-72b1073283a1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e6abdaf3-35a4-436e-804c-72b1073283a1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

a5715ede-6c1e-470b-a683-93bcc9b1cb1e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\a5715ede-6c1e-470b-a683-93bcc9b1cb1e.tmp
Size 269KB
SHA256 06f17e41963546038d5f88fd063d6e15997003d667e5c78595938faaf36775e0
MD5 70ca79445d98af70b2e39fb8e7cf58d6
SHA1 77cbcb55493198a7e0c4ee7ce056d1c59d9c21a2
SHA512 aca0cd7ab8650a7dec9a10f589b7a8070b88733dde88a076ba05ffa2a549105987060ab06eb35524df38abb2468e26e2feef028e0c0582867cd9204e9586eb54
SSDEEP 6144:IHCsUfw5u7eC94LUX4rY7Q/C0+hFD+7t56OD9ZfSAppr8/:7s2w5Ee5Hra0yFSXD9ZfS4+/
TLSH
T1364423F1DF6A186B1EFC4506B21773084F7ADDE599CC2549808B7E4B309EB990263727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

334ef802-dc11-4e71-b84e-ff90aed89906.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\334ef802-dc11-4e71-b84e-ff90aed89906.tmp
Size 18KB
SHA256 8801fd550e44573d12ebef051f59c1276fa396cdf10982b4423f97664064484a
MD5 60359400edbf7aa8a71a4cac621adf49
SHA1 303dbad8cb9d2fba30e788c0e367edc0d2a211d2
SHA512 20db622a5d0fd3e79552071adf5a9e77e1214b5723fdebfea57aca3e0ce4b6cb1d52b7b0f641255630e9b69ec21de499b1724d26abf9bcd208554fb058a54df0
SSDEEP 384:nfQkUSvWsNaUQZNiprrQX5+DtN8zX3+2m852IdIIlb:hWnYckD03lm855dLt
TLSH
T1B5827D31ACA8AC2799F7D641F18A3143DEB45117EAC85F94DADD6F2C01CA2DC234B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35eb4465-4a2e-4d21-a164-a3c81257634b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\35eb4465-4a2e-4d21-a164-a3c81257634b.tmp
Size 8KB
SHA256 8dcc1db3bec9a986cd7f3b546a68d65ff89b248a9211c3b71115c46c919f33b1
MD5 74bef24dd2201675909a064358d6121a
SHA1 11ddfa24d13ec4fd12411239ad44de0e2a48c8cf
SHA512 55def38e48c1fed9ef78e662db1f6d727539d98642846f5b287ce06bd89bdbd8851d278b6ace096ab522850d3795544a545fe4e66f6ad1d51e2ae1972605d5ad
SSDEEP 192:zONo6nnHfQmiUyLgpYcX5hQDP1xjzor9RzX1x+2Wg3Pq55U6:zONo6nBhpNX5+DtN8zX3+2x85U6
TLSH
T1D5120B31E8A8AC6B5EE3A595B08731139EE52117EA857F80D6EC1E1C01DE6AC634D827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ced0adc-97e4-4775-a292-338d4674ce4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7ced0adc-97e4-4775-a292-338d4674ce4d.tmp
Size 8KB
SHA256 e406739bb850273edbdf54f9cde6c7f271b70a6090bab5a0a4e077b9d35ade06
MD5 f3137abc14ee45720422dfb5c36b6dee
SHA1 c68ce35cefdfae6d4578477be08c58ac3319915a
SHA512 c6b26544fc775c2b43a278ed51a2a67853424a3f8d68fc4651335005f4d647a955fa63d22313062ec5f92b9fa601dfeca4d8c6a763c3bdb279ccc9d8a6fb43b0
SSDEEP 192:EONh6nnHGQmiUyQgQYcX5hQDP1xjzor9RfMcvwU6:EONh6nCcQNX5+DtN8DIU6
TLSH
T1D602EC35ACA46C7B9BF3AE45B4873713AFE4213BA5956B80DAE81E1C00D765C2306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94dce12a-6bbf-4433-b176-0312dca5841b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94dce12a-6bbf-4433-b176-0312dca5841b.tmp
Size 18KB
SHA256 a9347929377c7f25c5cce3fed3f6fbdeabe8036d627180af9d21c14ac521cbaa
MD5 b7247fd2657b27446b4adc6ee83262d1
SHA1 82bf72641f34a510e7de26c1b5053c476b62f62f
SHA512 9722745dbd3d0d462fe1f5044357a6009091f278bcba33c10c8e9bc4f0bc5ac1b80a628ed329bf0c9b8f075f218286f4c37e2e527493e44d35a0e60ee8968254
SSDEEP 384:n5QkUSvWsNaUlZNiBrrQX5+DtN8zX3+22852IdIIlb:bWswckD03l2855dLt
TLSH
T153827D31ACA8AC2799F79641F04A3143DFB45157EAC85F94D6DD2F2C01CA2DC234B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

2e553777-dba8-409e-90d5-e160530d9081.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e553777-dba8-409e-90d5-e160530d9081.tmp
Size 10KB
SHA256 720ddf39e1ba6fb94401a2824ddcdccabaf2dde16a60f14908d67e27723e614c
MD5 798a7c1a168ab8cfe3e86cda522c32aa
SHA1 23efb9299e79fac262cde30a91f376a832b595c6
SHA512 80dec681912d4878d4a1ab1635ac3e25fb7fff52fba284d7feb99adc68ec578cd855dd688e0077e9b8f3339da3758a9e2e2738c4b2610c4cde1f295a56b6b402
SSDEEP 192:sxZgR3Wq/f/sJyFA3LwVIdp70HHW6+WNffoXYYB1eY+yYIg50J:sxZgYq/f/sca3JIHHboXf/n02
TLSH
T19132FA11AE28697B8CC7E21DBA557F53E6F95032A1901E58EAFCC61C05E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51814faf-fc23-48ec-915a-63572ee1ab7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51814faf-fc23-48ec-915a-63572ee1ab7a.tmp
Size 10KB
SHA256 21e1df759ec9b42ad518f16535ff6c889dacdb916159ee11b4b3f20d438090b0
MD5 6a5f88b98922727011d8fadbd767c0f8
SHA1 9b5c8e2499816926c3b79db743b0dfb0434555dd
SHA512 dbb5a7022edc425a06246099916d43cc6030f474231c0ecc5c99f24197b616ec0d0de57ae3e9a4d4809c79beffce33556ad462f73067fdf1ece0acf95c339429
SSDEEP 192:sxZgR3Zq/f/sEWFA3LwVIdp70HHW6+WNfn9/YYB08Y+yYIg4J:sxZgHq/f/sFa3JIHHbV/fEn0c
TLSH
T19A22CA11AE28A57B8CC7D21DBA657F53E6F91032A1D11E58EAFCC61C05E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

964263f7-e62e-4a30-b6e3-3dc5879ef7c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\964263f7-e62e-4a30-b6e3-3dc5879ef7c8.tmp
Size 10KB
SHA256 4bedaea10b7fb43aa6294f22aabf625f66937bfb8e6108059354e3d25faa117b
MD5 56f6e1e9b328f42f629794065fc9ab07
SHA1 c45676b22a3f1d4a55248b43ff26d0a9f44c96fd
SHA512 d91ecc8a16de9b3131ba75321ffcfc8b873f3762fc08383dc6e9e05d450406b418a5ac45c742296bc8bfe702f78a2a2317e80c026b13d34c4989453a18666e0c
SSDEEP 192:sxZgR3Zq/f/sJWFA3LwVIdp70HHW6+WNfn9/YYB08Y+yYIg5CJ:sxZgHq/f/sAa3JIHHbV/fEn04
TLSH
T1C832DA11AE28A97B8CC7D219BA557F53E6F91032A1D11E58EAFC861C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 5a41a1490147dfa52e22cb0158da6be76dc057d0ae7f4e21cadbfdd32e4ef509
MD5 0ea7ad3b83e25119fd8bf505dadb2f99
SHA1 127ef1717a54bffe8e8e61bd77708ff6d94e9ede
SHA512 38a67f06810bf6c6a37c074d6098acda9abadabf3b2b7530c5b13186699c78aa687432bbf2142760b7298f4a53f835df496a7ec85b76d54bd5dd985041ff6b94
TLSH
T1A5E026E444C8C23FA6487487016D930CC3A03A1E93C0AD8E1704C9CDB40A040B2C27D0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a664924a8d83f1a6263d16d35fd16db71a03b51d3dc809ec35a737db4a2f1698
MD5 0a07d7f1dc08d8bcfdaac71f80c0b40a
SHA1 301d03235741efff4348bd3d2e87146db446ec49
SHA512 4b54a4964b05d84d1d3f50089b29981882eb5468889e85bf4d13919f2fc612b7cd3c72632783ccfcb580a0a151c25a249391c425aad46622b72d88aa246650c9
TLSH
T1926195B590434057FB9940F0E9D8118B3EF065BD95838E26E5A6D177982EF3BBD40CC0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 112396c263810bfaba5e5d7454870a1e609e288e2aa91204b5630ecc5371a218
MD5 8c33888dc387bf64d0a50fff42309991
SHA1 6eae66a3db57c9c9cbce81068bd7b0c1fceb00a1
SHA512 9f5cf3331338142ad1a81bfb416d91104ad0465868c7024f23624872ffdb0a4c15279b48a0c6c77bc7978a067f9a47ba54400e195bb669fc3ccda33a83342f4d
TLSH
T1CD61847495434157FB9840F0E9D811CB3EF0A5BD98935E16A5A6D277986EF3BBC40CC0
MD5 SHA1 SHA512 TLSH

Submit Download

ae8b632e-a642-43bc-8001-769419615154.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ae8b632e-a642-43bc-8001-769419615154.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

87c8df82-03d8-48b8-9dfb-f4b6cfdc1d35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\87c8df82-03d8-48b8-9dfb-f4b6cfdc1d35.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 de4ab53ce54dfa2e1ca8ac54b6372cce830c6904efe4c017666315bc602834c5
MD5 e2bac00433f15d9778514e5bf3fe941b
SHA1 6810bee28369ffa319f0c71b50a85decc80d7a18
SHA512 2c59585573cee8b1da7d638c0079e8a751f0a53001b2a9b06eedbac0b18d2c527b35a7ca8669f0699464c07d267a609e822af0da0b01a805992a5351f99d9432
SSDEEP 96:K40xCGMWyb5CXqjubK7ijIb30cPqSoqWP0geM8l5odYjIlK7UjafmKscSur6KggB:otlh9l8
TLSH
T19AA14551307F020039BE2A4D46B8876A035270B33168A5BA7BA8C6F55E5EE111DFEDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae7f88c3-b262-4a4e-ae7e-99d62346f3bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae7f88c3-b262-4a4e-ae7e-99d62346f3bf.tmp
Size 32KB
SHA256 391b7d62754fd6d3774737356bca446d03d8f9a23c9f0813dbd05d7e7753069b
MD5 a279fa137f17ad083d158e37b85c6ea5
SHA1 d8858f1679f602bd4ca596b42bad1d1f1863285d
SHA512 948f232e07f2bf1364d79bce00ca3b9afc00f3151bad73f327a6ad34da75e3eb62a9e9d948221a6a2ae80534fb7a7363e23eb085e2a33222ec63c8be97a9a82e
SSDEEP 768:ItyYRQf7pLuLjbjWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAw/CLlGcvXoroh:ItyYRQZEjbjWv3NpBu1jaRw/CL8OXTh
TLSH
T1DDE2E93B680DCB7E4FC04A9DDD1A7F9E6DA8028B9698C94047FA945C02C7BEE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e290114e-666d-45c4-98e6-76abd7361d31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e290114e-666d-45c4-98e6-76abd7361d31.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87446b06-39c8-4ca8-abcd-15884a3f4716.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\87446b06-39c8-4ca8-abcd-15884a3f4716.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5413e65-e469-4edf-ae32-feee9757fc5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c5413e65-e469-4edf-ae32-feee9757fc5b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a299cef602c96c190f710943bb35ca7ae80c6f16543fd2a93ee9d3f47aa1fab4
MD5 b3ecfc273838f32c6267a3bfa92db927
SHA1 69b2454d096ee8fa3f95ba2b6c5c86741e4dd945
SHA512 ab28739fe217386f23e1c3e98e91879eae2f6b25f43782f55b6415618f7ba3b190098ae27d031b44be887cb98c8ed20e9c550b4f25373010763be66129f24a52
TLSH
T1BB415D58A6FA1108F3B7AF5A9BF6B86D483F79372E06D49D10010D4F4A67A00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 ade6bf3f7f8fe281b3fc0cbcb037341f7c8b29e933c79d941d4b4d1ac1911dc2
MD5 f006b452134205c46d210463fb57a99a
SHA1 12d27f749da0e13d4943e3a9e400f18d986025a1
SHA512 1435d4bd8a672962b2c0a1d2e0240bd78822a0052ac7bd2ace0b2c71bfa18c9166734a58b275a9719766767699e831fc043c0bc62266953b14c0406c6133b407
TLSH
T1AC51605CA6FA1148F377BF569BF668AE547B79733A06945E10010E4F0A23B00C4A1737
MD5 SHA1 SHA512 TLSH

Submit Download

44d45be9-f879-4161-b80b-2b73eed901ac.tmp

Path C:\Users\Admin\AppData\Local\Temp\44d45be9-f879-4161-b80b-2b73eed901ac.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

711a0ba8-3324-485a-b5b0-89cfd102726f.tmp

Path C:\Users\Admin\AppData\Local\Temp\711a0ba8-3324-485a-b5b0-89cfd102726f.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

injectorlog.log

Path C:\Users\Admin\AppData\Local\Temp\injectorlog.log
Size 65B
SHA256 4eef2d9aabec3551e2ec41803e100850bc7c519cc8dfa9c7f316f112aec4c7b7
MD5 063af6ef500037edc5b366011291650b
SHA1 fea8e739ed2b968d63df951b15e2dc21a37ed406
SHA512 4a354740ae469a30a9a9f8de02e466e66b78c6751c4f6dad88a9a4c820c3323fc0cf3b398a8ae04b1e4c7b85069f3afc5f5c9dbd625ae7aa87e42701552e94c7
TLSH
T1E3A0020E47D885D3BA08C35AE1EC1A91B2A5B9691ECC44583D56F53B80483D22ADFF85
MD5 SHA1 SHA512 TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-18253.tmp\_isetup\_isdecmp.dll
Size 34KB
SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
MD5 c6ae924ad02500284f7e4efa11fa7cfc
SHA1 2a7770b473b0a7dc9a331d017297ff5af400fed8
SHA512 f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
SSDEEP 768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
TLSH
T11EF23AA1BDED1F53DA8A0A3056C994235C31E1D44B0008F7D5D9CA672A8E3A75FB329F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BakkesModSetup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-IBE9V.tmp\BakkesModSetup.tmp
Size 3.1MB
SHA256 6c0c57a9dea98d5a31dbf99d880dd828d094965397fe453f20fe186c55b33265
MD5 8f4a51f9a89e8e04fc8a465436b5bba9
SHA1 97e3a485e2248da74afa556d550c1fe0c3e9629d
SHA512 16fd012759c93c641aaf9e4384f6b1a90df4c1678bc2f4555bc46aabef67beaf1f2fb72fbf9b2b8149fcd007fb2115dcb03e59837833ec74354a2a2f1e63dbc4
SSDEEP 49152:/EA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVUjq3338o:D92bz2Eb6pd7B6bAGx7Cq333n
TLSH
T143E54B17F788723ED06B5A324733C6D89837BE6169128C17A7F8384C8F355942A3E676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09e97f6a-3830-4960-8aef-7020cb531228.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2156_1577311698\09e97f6a-3830-4960-8aef-7020cb531228.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2156_1577311698\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2156_1603401163\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

9d95da47-5312-469b-b226-489e359f603f.tmp

Path C:\Users\Admin\Downloads\9d95da47-5312-469b-b226-489e359f603f.tmp
Size 15KB
SHA256 6e136e47a1875bd2e58fb43107203517c3aca2bac312956d405d688b08db64db
MD5 b115f19b472a52314fb68e0d20fba21e
SHA1 a2465fdb7ef1f8aa8a11a527a37a88e00cefe2f6
SHA512 915ee15cf0f499571dc1d135e3cc36412fdea43ee50dcb349dd5b6f7100e9bd1d5fe87fc0f8ac977360b50cf04ac82d59e2affc23718d9aa261c37f3e3ac7199
SSDEEP 384:IruSIPJpUdF/LNGbNKp0SNo45u3K+oVqwxXVP9zuqKbrF:UuSW3UPLNGpKtOfoI4VVuqKbrF
TLSH
T1EC72D0DB29E99B13FD3ECBB0B8643DEEDC97E0865490C5988A1234B81E4BDC1917D4E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BakkesModSetup.zip.crdownload

Path C:\Users\Admin\Downloads\BakkesModSetup.zip.crdownload
Size 9.9MB
SHA256 cda33c89671b95c156be05d015c2a9dcf04c18b09e0c0c78ce51e879ade0c157
MD5 ad94c62eefb7c344fdc600607bdffbfa
SHA1 050704a3ec894970e988e69d81e89a14f248fe3a
SHA512 fb181f0c442e43b36674241300b427443de445545a9ef44bcc6d4c99ea2ffbd106357ccc54e09d3329e578f1cc3f8afb557cfc109e70c6968532931796030989
SSDEEP 196608:luNf070AfadzVnolSQosXS8ksRMXKFIOH1QBpTGa8yJlqzd6P1i5Ia7K:luxx3o0L8ksRMaJkvxbqzGd
TLSH
T13BA633263AC49A780E63D4F0CDD9A27043860FF2B45931CD92A4A4FD9269952D1F8FED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BakkesMod.lnk

Path C:\Users\Public\Desktop\BakkesMod.lnk
Size 872B
SHA256 94608d417bca27ea63905bdb717396c4ce2dcdfc09f242a2c08032de2e63b8a6
MD5 d8d7cd056d0c43e6ad2cc45335454a0f
SHA1 f2a457cecc2c6d319e8a0e8b62b1f88e590b9ee0
SHA512 be8961e7918ffaf98e0ff1240f175c51f0a12eed61182dc1c91443719a9bd4a9b14225c90e8765c7e100ad7c57d6d84088903212c851f1016782b93c1ef81aee
TLSH
T1F911701017E327D5E2F349B66BF257324377FA0A9B090B2E60CD42801DF42859B7CB66
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1604-344-0x0000000000400000-0x000000000072D000-memory.dmp

Download

memory/1604-389-0x0000000000400000-0x000000000072D000-memory.dmp

Download

memory/1604-264-0x0000000000400000-0x000000000072D000-memory.dmp

Download

memory/2964-0-0x0000000000400000-0x00000000004F3000-memory.dmp

Download

memory/2964-13-0x0000000000400000-0x00000000004F3000-memory.dmp

Download

memory/3028-223-0x0000000000400000-0x00000000004F3000-memory.dmp

Download

memory/3028-390-0x0000000000400000-0x00000000004F3000-memory.dmp

Download

memory/3028-257-0x0000000000400000-0x00000000004F3000-memory.dmp

Download

memory/4328-12-0x0000000000400000-0x000000000072D000-memory.dmp

Download

memory/4328-5-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download