hxxp://23[.]155[.]44[.]149/colord[.]exe

Resubmissions

30/10/2026, 11:49

261030-ny2w4abx8t8

30/10/2026, 11:07

261030-m8faeaec698

30/10/2026, 11:07

261030-m7zbwsysay8

30/10/2026, 10:55

261030-m1f7qsbv6w8

Analysis

user interaction
yes
max time kernel
900s
max time network
879s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://23.155.44.149/colord.exe
Sample261030-m8faeaec69

Score

8^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	3088	msedge.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\dllhost.exe	dllhost.exe

Executes dropped EXE 2 IoCs

pid	Process
3348	colord.exe
4716	dllhost.exe

Loads dropped DLL 4 IoCs

pid	Process
3348	colord.exe
3348	colord.exe
4716	dllhost.exe
4716	dllhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Themes = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Themes\\dllhost.exe\""	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	colord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	colord.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dllhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3088	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{0710E644-64E1-474E-80F4-769F5DB9F912}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1264	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3348	colord.exe
4716	dllhost.exe
2516	msedge.exe
2516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	colord.exe
Token: SeDebugPrivilege	4716	dllhost.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1580	4104	msedge.exe	89
PID 4104 wrote to memory of 2496	4104	msedge.exe	90
PID 4104 wrote to memory of 3088	4104	msedge.exe	91
PID 4104 wrote to memory of 2496	4104	msedge.exe	90
PID 4104 wrote to memory of 2496	4104	msedge.exe	90
PID 4104 wrote to memory of 1296	4104	msedge.exe	92
PID 4104 wrote to memory of 1296	4104	msedge.exe	92
PID 4104 wrote to memory of 3852	4104	msedge.exe	93
PID 4104 wrote to memory of 3852	4104	msedge.exe	93
PID 4104 wrote to memory of 3852	4104	msedge.exe	93
PID 4104 wrote to memory of 5468	4104	msedge.exe	94
PID 4104 wrote to memory of 5468	4104	msedge.exe	94
PID 4104 wrote to memory of 5468	4104	msedge.exe	94
PID 4104 wrote to memory of 5540	4104	msedge.exe	96
PID 4104 wrote to memory of 5656	4104	msedge.exe	97
PID 4104 wrote to memory of 5540	4104	msedge.exe	96
PID 4104 wrote to memory of 5540	4104	msedge.exe	96
PID 4104 wrote to memory of 5656	4104	msedge.exe	97
PID 4104 wrote to memory of 5656	4104	msedge.exe	97
PID 4104 wrote to memory of 5636	4104	msedge.exe	99
PID 4104 wrote to memory of 6140	4104	msedge.exe	100
PID 4104 wrote to memory of 5636	4104	msedge.exe	99
PID 4104 wrote to memory of 6140	4104	msedge.exe	100
PID 4104 wrote to memory of 1632	4104	msedge.exe	101
PID 4104 wrote to memory of 2732	4104	msedge.exe	102
PID 4104 wrote to memory of 1632	4104	msedge.exe	101
PID 4104 wrote to memory of 2732	4104	msedge.exe	102
PID 4104 wrote to memory of 2732	4104	msedge.exe	102
PID 4104 wrote to memory of 4540	4104	msedge.exe	103
PID 4104 wrote to memory of 2672	4104	msedge.exe	104
PID 4104 wrote to memory of 2672	4104	msedge.exe	104
PID 4104 wrote to memory of 3412	4104	msedge.exe	106
PID 4104 wrote to memory of 1888	4104	msedge.exe	110
PID 4104 wrote to memory of 2188	4104	msedge.exe	111
PID 4104 wrote to memory of 4540	4104	msedge.exe	112
PID 4104 wrote to memory of 1836	4104	msedge.exe	114
PID 4104 wrote to memory of 4604	4104	msedge.exe	115
PID 4104 wrote to memory of 4604	4104	msedge.exe	115
PID 4104 wrote to memory of 4604	4104	msedge.exe	115
PID 4104 wrote to memory of 3348	4104	msedge.exe	116
PID 3348 wrote to memory of 472	3348	colord.exe	118
PID 3348 wrote to memory of 1264	3348	colord.exe	120
PID 4104 wrote to memory of 3464	4104	msedge.exe	124
PID 4104 wrote to memory of 3464	4104	msedge.exe	124
PID 4104 wrote to memory of 2516	4104	msedge.exe	126
PID 4104 wrote to memory of 1148	4104	msedge.exe	127
PID 4104 wrote to memory of 2752	4104	msedge.exe	128
PID 4104 wrote to memory of 1148	4104	msedge.exe	127
PID 4104 wrote to memory of 2752	4104	msedge.exe	128
PID 4104 wrote to memory of 5200	4104	msedge.exe	129
PID 4104 wrote to memory of 5200	4104	msedge.exe	129
PID 4104 wrote to memory of 5636	4104	msedge.exe	130
PID 4104 wrote to memory of 5636	4104	msedge.exe	130
PID 4104 wrote to memory of 2632	4104	msedge.exe	132
PID 4104 wrote to memory of 2632	4104	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://23.155.44.149/colord.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff4ec4c188,0x7fff4ec4c194,0x7fff4ec4c1a0
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,9484228897201375542,5397820123061055493,262144 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,6239414006844034118,2584901459241380681,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,786626152596637377,14986515488822779102,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:13
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,1311694605710304688,18066112891412727936,2097152 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3676,i,8954256129736614748,14452678128711604317,2097152 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,16710473706168934595,6803839307045228442,2097152 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,10381891064510014662,101662212393674631,2097152 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:9
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,4192338306326315574,16299665083423627202,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,2647357332855965870,12314552044468253907,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,5372847887254609798,2947122498268801767,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5908,i,11468594474052234065,760030079746704239,2097152 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,17207489278463279813,6947070675282477307,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,18026637278418341761,15038764328249793944,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,9628070881369370415,8341483598653648668,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,9628070881369370415,8341483598653648668,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,16831901233554469236,6104262599048106958,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,6950305746005153544,5939416764211056064,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,8336447471010133135,12165398584919019031,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,6582706428990917747,12861177512516840570,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,6582706428990917747,12861177512516840570,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5784,i,1000293769355122431,10204663767691252186,2097152 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4604
- C:\Users\Admin\Downloads\colord.exe
  "C:\Users\Admin\Downloads\colord.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SYSTEM32\reg.exe
    "reg" add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Themes" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\dllhost.exe\"" /f
    3⤵
    - Adds Run key to start application
    PID:472
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Microsoft\Windows\Themes\ThemeSync" /tr "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\dllhost.exe\"" /sc onlogon /rl LIMITED /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7404,i,310574613324806306,3048809271018735865,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=836,i,12633460690571073954,10818695381811108691,262144 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,4912444347652183309,6132071979143351150,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,2348547404500138039,4930516797953065578,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,8152976705282333340,12423075797462002078,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,7401131518611562206,1696076227808859156,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,14893799675067164863,2791425301083664615,524288 --field-trial-handle=2244,i,17554396098697206503,4680828806534226443,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:14
  2⤵
  PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5928

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\dllhost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\dllhost.exe"
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3904

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16a09525-0451-4c74-af4b-a523b290ed7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16a09525-0451-4c74-af4b-a523b290ed7c.tmp
Size 36KB
SHA256 f51529b82a4727a34e96161803a62a8a840c8b6db1205d07a40b61680fbc64c5
MD5 ba705e52f64e42db252b972e6fc8c633
SHA1 d8f02fdd8b6b5521e01949c928373557f8593e73
SHA512 a5962c0c80e45abd111a74982402038b9c120799d8d035770e9b2f24da40a16e5c5b368f85a98753157f217c5850f80c39efa76b40de7aaab762a6537a107a54
SSDEEP 768:KFSO3fwgEM14ybNbYs6jOeRFZD1fTos7RjC6ZusLR:bO3iJ65Y1fT/RuuNl
TLSH
T188F2AE36BCD48D779DBADB80F3493643EFF44263C99A4A9496CC6D0E018B6ED134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7196f794-1f80-4102-9c53-f82b169fcde8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7196f794-1f80-4102-9c53-f82b169fcde8.tmp
Size 33KB
SHA256 e1f8d4fb9af32f54ef7b9baf4853acda46b218a2c482c429a89a6f8795ce5d47
MD5 e30cae0d22f9798f8fc07f1e9b452085
SHA1 1f646e118d35759b45a0cc5e28867b0974ea72af
SHA512 f88a23004ec99a262c2fa1019d22ada9c85c5d65f9a30d7d4dad6f9839245f5834801ee8271766d915288639cad4427f81222dfff699deee277430e2bd9963de
SSDEEP 768:OQ3EM14ybNbYs6zOeRFZD1fTos7RjC6ZusLR:OQ3EJ6RY1fT/RuuNl
TLSH
T12EF2BE39BCE49D338DF5E290F24A3647BFB44263CAD90A8495CD6E1E05CB7AD134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

781aa71b-1905-4fda-9346-c8fd90fc2291.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\781aa71b-1905-4fda-9346-c8fd90fc2291.tmp
Size 38KB
SHA256 f15b6c11a2b2e8263465bb34e9965eb36bd2a86d7ca3203411feb6e9594ac141
MD5 ddb9aa99056f732019028ae8aa823701
SHA1 4560c60a98b489c5c41189dc73ceb5244c2d4b83
SHA512 929874c783ed0b02859a365bd4bd2048dd5c37dffa98870ccf8408a47efce6486e275092955e9d812ca3f1d51424ae9681b27df8cc704a1644c7c8fcebc1489e
SSDEEP 768:H/UxvxjgC+E3Nh14ybNbYs6COeRFZD1fTos7RjCGEb8p:6Zj3+E3NQ6AY1fT/RuGrp
TLSH
T1D803BF3AB8A49C335DF6E244B24A7787FFF44563C9CA199845DD6E0E05CB7AD030B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a81072c-8bd1-4d82-9f10-6c6c371960a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a81072c-8bd1-4d82-9f10-6c6c371960a1.tmp
Size 38KB
SHA256 9b43d2c0182b21080fc8678575348fcc8de2596e2583fd299a01f37c6049564f
MD5 b4b0c3f5688f5ab28b84f43c3e14ee4c
SHA1 7b8206d3d33f6a631ac257492ad5b2e03a668ce7
SHA512 a5124a7d16794597eb3bb6a4631fd5ff9faa22c88fa2a7be6e9be0f2380fa28e5ec787265e832b62101cc6163568454fb501eeb935f1e12d9d818923089fc6cd
SSDEEP 768:D/UxvxjgC+k3mo1OybNbYs6YOeRFZD1fTos7RCC/+Pu:WZj3+k3mH6kY1fT/RRKu
TLSH
T10A03B03AF8E49C335CF6D244B24A774BBFF455A385CA1A9409DD2E0E158B7AD130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80e60467-7433-43cb-ba9c-ea7d78bf2446.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\80e60467-7433-43cb-ba9c-ea7d78bf2446.tmp
Size 33KB
SHA256 3cd93473949ee5e05b48385a4f6fc130c2d7077d2d5d73ad9c54e5ba9415505c
MD5 f2abc1b781f6157816a3103b963b1fb2
SHA1 24d466ef1093df93b041f67ee5d146a4a879e8e8
SHA512 5e977164d3eb07ee407fef4d7063bf3d621f40cf9fdc6c21ea8519a1bf0021f6c92af16b12ad73ad7ce7eb54807eea1dd7ef3b532a6b51f4ae8fbc95bfdc1af9
SSDEEP 768:sw3Nl14ybNbYs6iOeRFZD1fTos7RjC6ZusLR:sw3Nk6aY1fT/RuuNl
TLSH
T157F2BF39BCE49D338DF5E290F24A3647BFB44263CAD90A8495CD2E1E05CB7AD134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

77c2134f-4ca4-4256-bf24-5da5b01c41ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77c2134f-4ca4-4256-bf24-5da5b01c41ac.tmp
Size 11KB
SHA256 1e91905032428e8d71399862526943b99e65a82757c50e875b5e7d44f2e5ca89
MD5 06544ff68b31e536e110ce4affc86f46
SHA1 ed5a1f3e275d5e60fba5661f9d76c4e954d6e538
SHA512 bec111f3efd8bce1bfba8e0d0f3992d845f96a189c0378f76ce2837f9bc209229b8320e7dab7714112a68844cf07c25f8502cefb7a33c9933993c7eefa41dece
SSDEEP 192:sxR4RAOe/fysZmK7xAbzoA8pi/q96+WNIYDSRxG4IgIJ:sxR4he/fysQ6Bi/TI7s
TLSH
T10132A615AD68A93B8CCBE21DFB65BF53D6F95032A0901E58E6FC861C14E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 3074cc34d051fa9b05d1854e62cdeb0020cf320fcfe65d73fb2b1ae1ed9f4ffb
MD5 70ca9dbef1b8cf2ec89dff7e91e5063c
SHA1 cf60493df44ac8af44f8bbeec4109a25c45c71d6
SHA512 59e2dc4fdaf5501f2a4cbdf2e3579e3e12341be30041fe9afae57cbfb99d15bb4cf8c6a89f5a10cac1c9a83f6c555a27bb48dea29faf6e0cbbf5b75f4a26e82d
TLSH
T1E5E0269CC5C8C32EF60CA44B427C630ED7802E5BD2C87AAE2700D6C4700DC54A2A77E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 08ec439fe6680bb59de2ea0b2bb3a777b9452ee6f79670b80e313fc1e3a9e456
MD5 0706b8f8acb6494d74a2ff6656b93826
SHA1 0e05210860d0a61ffea8b58e94f6913e6b45ab78
SHA512 6822a7c5e87f47ba9b7ca20fccec6140efe25da74d2a27f245684b295674f0883c76d72cde674ada74e6e5846dfe45bd44a6c302d993eceb5dca22f55207fa0b
TLSH
T133E026C658CAC32EF25C648B02B8738D838126FAE2C0691E7B00D9C87105558A7F76E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 5b85c87b6d82c69c5fb88624b85affb62dd66d7e6cd7dd8095a80fe7e63b03b5
MD5 1eee792e26db3fa0e227ff669b6a54c3
SHA1 ffe80b29d9e250060a57853e8769890b684e37ea
SHA512 919892974b956397760326b9a2127ec09579d35ed53d74699ed6155dee64abb41b9446c63d0ace6119eb73d1d1c6c0147883c2a37dbf2d02ccb2a0623736976d
TLSH
T10DE026C658C9C32EE79E64DB5278A78D8380369FD2C0A92E7B00E9C87005454B7B66F4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 70b794f3fa5e98da772840d199f73ff1b502605e5f70840b05fe394a3f41c056
MD5 3b4a4c18961bace2ab6f5ea3bb308c5c
SHA1 2ecd63e425a6821fb1599f2c7ed498261c2a53c7
SHA512 e26b00bb53f086583c5a9eb1554e793e6c2badb2199b07a7787612c9744924acef7fbf36702a4fecb687f558846853347dfdf74166b5f8a79604538f8b668c4b
TLSH
T10241EA48D59DC469FF6826B180D927873638AE7DDDCB5E4A176CC4BD6B737234E00028
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0211a6e4b75375ca3bd116e908d30677789c30a56e1e61f26186f368959a2889
MD5 1da8aff4fedf3c0fc5d6814526da801e
SHA1 e9a9b39d74c5b91b6f78ee558f46f10c464022a3
SHA512 d52efcac073c75c4b8142e05200db800edcd79bb741bafd8c3c523e1410b268eea13495b7d8173870b8c0ffdb68bb27509a6ee8e3c031f0bc9540e8d48707014
TLSH
T12341EA48C69DC468FF6825B180E927873638AE7DDDCB5E4A176CC4BD6B737234E40028
MD5 SHA1 SHA512 TLSH

Submit Download

b0465168-edf7-46fe-9ea8-3f5aea2d5925.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b0465168-edf7-46fe-9ea8-3f5aea2d5925.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0ddbdbfe-fa7a-4ff1-a5c4-604e516f99c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0ddbdbfe-fa7a-4ff1-a5c4-604e516f99c3.tmp
Size 1KB
SHA256 fef74529337e19e296c62009d2466a65475dd5961b74b52c3f6e31019688db4d
MD5 5bd603d1a4ca0ac2afe2ae8bf2ecd65d
SHA1 cfe7f324512c8f80d64d182679ffee346508b078
SHA512 31c488108a367bcb3949265569d513eb36b91b3017f48951e30a30ec3295d63ef7c8e459a495609a312c9917dd7c179fb210f51bb3d9d457e3dcb645a6b6116f
TLSH
T16B31E2F747B4856EDA0196F0EA04AE2FDE2D0415432C7CA985E0AE27D3F3072E041B9B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a0599756-43fc-445c-b547-0c9d43cd1c55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a0599756-43fc-445c-b547-0c9d43cd1c55.tmp
Size 1KB
SHA256 ab239070b38c73112c1ef6353e91c2a444f63981f70e3e1f70e395093b11b2ab
MD5 94041f8d9069d9aa2a204bdd142a7f19
SHA1 95c19516be55a09f8ee9c50f464a47532ff1a4d0
SHA512 f352bd51c500f4391c6ef59cdd8be53a66fd68b6f041de2efb8369191d613bf10733880bc0394fe5e3ac02233f7f1fbf97631b3087b58dfdea4a2eb9f7f70ddf
TLSH
T17C31F3F383B4957EDA0196F0AA04AE2FCE1D0515432C7C6985E49E27D3F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 271B
SHA256 188e468eff993df10f79dd1056e4b65ef42d7447cc7486bffedbd5b4d22c34c7
MD5 f91a06351e537a86a13b6a3781bb082a
SHA1 d0d157325b1a1d56eb1a8fdbebeadb5f3a257086
SHA512 946683b4a88bec433fb8446e9cb0e3715c7e3107ce5a589b0370b2c1604de3fb96a17531bc7ed1f52b0791ba20a76ff3c3676fbafb359e7f7899fb51cb3e1b1c
TLSH
T18ED02BBA5CB908109CAF8BD270314066420278A8CD84BD8D1019A28B10913103813D30
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ad902998-81e3-47d9-a4a0-5afb3da5d568.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad902998-81e3-47d9-a4a0-5afb3da5d568.tmp
Size 11KB
SHA256 9e147e155ef1324d97edb1feaa8f9aebbc5928f6b468443803fb8cc58fc050df
MD5 18db66d3c5f6b5e1b73079807bfaf88f
SHA1 e14a6dba314bda057672c64fac6b0fb5e8293062
SHA512 6dabbaa40f60a7678553c312d81b39d8075ed1fc916a2e707556d8105c50b75d400c2165b845fcf4d67b102a3006114c1484f9013448646eabf16a1a001c5975
SSDEEP 192:sxRrRAOe/fysdymK7xAbzoA8pi/q96+WNIYDSRxG4IgDnJ:sxRrhe/fysr6Bi/TI7l
TLSH
T18832A615AD68A93B8CCBE21DFB65BF53D6F95032A0901E58E6FC861C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb3739fc-f6d9-4895-b6fa-1e1b84efd6de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb3739fc-f6d9-4895-b6fa-1e1b84efd6de.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f29ecf7b-5e46-4533-9375-6ff6dbdec4df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f29ecf7b-5e46-4533-9375-6ff6dbdec4df.tmp
Size 23KB
SHA256 d474e5b81f1d5ff8caf55f01dc89395fbc61b3b43e9847d5858fc7b611bff0cf
MD5 a61d7fbefdaaf5cd08e6b9b17a09cb7f
SHA1 6de0edf7db2f149ef9d4a89b9da646fab13aadd7
SHA512 15450f54135d2e09660c2590705320b57c1179012c67e94470a5daa677b8fc989c2b0725a1ab3a8ea8d6516efebc961e804639f0b300d44500ac6ab2f71406f9
SSDEEP 384:ScwYbpGfCtgaEFfA6KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVO+9W+R9rroTyz:SzYbpUWgasfA68F1+UoAYDCx9Tuqh0VC
TLSH
T10FB2C92B640CC77E4F804AADEC1A6F977D9802C796988D4047FE995C02C77FBA11A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb67decb-6094-41b6-ad32-b678c9670352.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb67decb-6094-41b6-ad32-b678c9670352.tmp
Size 11KB
SHA256 11dbfaf6c01edcac3390134e88123191e9d6b3647e955c772ae60bdcd5daa1e6
MD5 bf55723fc7cf1b291aa5d4c324c16d0b
SHA1 dc48a699e6ae86859ed2c233a79cd04ba25f68cd
SHA512 990d052ea3e8f109500fde5a213d5580c6c4ad2daa6af395cdfdf3aef725a4b983ee710accd382dca464452d890a1da0779fb40c450c98224e189f1020fd055e
SSDEEP 192:sxRrRAOe/fysd1mK7xAbzoA8pi/q96+WNIYDtJxG4IgD5J:sxRrhe/fysm6Bi/TIof
TLSH
T1E132A715AD28A93B9CCBE21DFB65BF53D2FD5032A0901F58A6FC861C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25ff8b9f-f45e-4993-b2b4-d662064ec2c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\25ff8b9f-f45e-4993-b2b4-d662064ec2c6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d9392daa-9501-4a74-b842-4dba4c6157a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d9392daa-9501-4a74-b842-4dba4c6157a7.tmp
Size 37KB
SHA256 8c44d0d337f81ea4ec61a1a21582465c0f8f9491a5ab2a609dfad155c910a573
MD5 d063d23f52d0009ae4cb6fa0fdd508df
SHA1 e725a42c5e2f75a7cd50cb589c969c44ea8c41f9
SHA512 377f355d7f80b13d1ace2b775b8b3fbcfbbe20fa483d83695a6c31409a1ce41cd8801be76364cb8558847880df86a2aad30f6a14d0d6f63e382fbdbb4e25fcb3
SSDEEP 768:z/UxvxjgC+k3HofybNbYspOeRFZD1fTos7RzI/+Pu:GZj3+k3HU6MY1fT/REKu
TLSH
T1D403BF3AF8D45D338CF6E244B24A764BBFF405B385C91A9809DD2F0E158B79D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbdb9c2a-f1f9-4482-89dd-03eef802e86c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dbdb9c2a-f1f9-4482-89dd-03eef802e86c.tmp
Size 33KB
SHA256 e6066e173236ab37bded1e27df0318bff9c69796e409ecedd2b7b30e9f6370f0
MD5 21078f313ff24d1e10f37ee8ee7c919c
SHA1 0a8a19eb928bcdad0af1081d8923a3e1eec559ea
SHA512 9221831a8c0f090be61f97cefcc8d2b92d2cb5f07987f1a1d0dc5de1437446d6b8c996fc8dfd0914c2a555778e18b725949152818a2b35c4a3ae40c92f4ea367
SSDEEP 768:ko3ET14ybNbYs6zOeRFZD1fTos7RjC6ZusLR:ko3E66RY1fT/RuuNl
TLSH
T183F2BF39BCE49D734DF5E280F24A3647BFB44263CAD90A8495CD6E1E05CB7AD134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05d5e4f1-a954-48d5-b8d8-9cb3a9fd19da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\05d5e4f1-a954-48d5-b8d8-9cb3a9fd19da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

colord.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\colord\hQnBl-R1cPxo\colord.dll
Size 188KB
SHA256 aae89872bfba488523efa105b468aa7fba6739a4111541047b4af6dd1024c41c
MD5 00506f787d3d0a0ac197d9c3c72d20bc
SHA1 97fd1c35b0975935a8a37d2b6efc89e4bb25359d
SHA512 621ef347176478d730387cb361ea6225b1da7ce75cb72e209cb667c8dfdf578e27a45a17a6f92eee74270676f1c7730745cc9e1968c66351c59e58179bb74d53
SSDEEP 3072:OB3tFbW9XWj0/ZtLSgMTXX+qOGZ4wYCLEQeKZbeHam4h8fD6l/nvZuDhJTQUAg:ivbcXD/ZtkTXXN96PCVbeHamlfD40L
TLSH
T1E4142A9877F84A01F27F1B7E98B151518B76B823A97CEF4E1C8990DC0A72780D515FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Concurrent.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Collections.Concurrent.dll
Size 26KB
SHA256 f1793823ece26aa914e165c81879ccf93a864cd97dc06f3462d4c13c1228c0be
MD5 94b2fd60274da7974bc5139794f2c7a8
SHA1 b1c558f88ae3c4ffcbc6abeb6e0a53dab75e8971
SHA512 9d42b569f51aca34f135fb65391c577632ad98d949b6f6b9d2d7572bbc1054815e9714261ec6447e5d16e6c8bd765954d7d7476d202d4edffed25ac53c13d71a
SSDEEP 768:ToFaEM4afXWau7SrGaDIYWBRwRiowDn+eH:ToFa/4afGaM/asY4/D9
TLSH
T153C2080477DD4733E9BF0BBBA9B144A00671AB626913C74D20D8A2999C73A401F7B7E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Collections.dll
Size 8KB
SHA256 48c483b9b4ef096914cc8a63c94bcf22843ccc9e0c4cc8196fc126e1ddbf6b3c
MD5 c7efb31f55775220c7e76fda9b481d0a
SHA1 8d37de0ef3d192a33a1251619e63efbd2f1528ef
SHA512 09d6e21b8a6003a9d442b91e9935a1849c8f8779f23cd0fb79ad92ed9737def52ead9c42489f052eae8e99ea8c9220f3a29ece96b729e599297222a8974b05d8
SSDEEP 192:yW52s67WtRFYE5IzAjz7q20fjexX2dSuWSkQWx:yW52r7kLT8Ajz7q20fjkGdSuWSkQWx
TLSH
T190029601B7DC8B37DDFB0BBAECA242844635BFA0AD12DF6D0544521B9C23A448673766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.ComponentModel.Primitives.dll
Size 9KB
SHA256 231388ec590f494ec33a3b693d1e76f110d93fca75f0decf7107be3d257442ea
MD5 1f140406cc824bab1c4203a95e096127
SHA1 cf6775ba04e74a72d0d16f3f87dc3d1da99f7ee2
SHA512 f9d6d5c60aafc0539bde80c961a9c13baa884b606198f122bc30d186b948c1352478105f9622bec33b7962f4ad5e4e1f4f3f17ea5120822ac26abe6c5e24fdbc
SSDEEP 192:oYBrN1SqpJr+8C2Z+If0Yzrx+wvmbUXMkP6oNmDWFZWx:o6N1djrBLZ+IcY5+cMkP6oNmDWFZWx
TLSH
T12412D528B3F84337CFAB0B35A932918107B6BA08EDA3CA1E45D5550B4D577545B32B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Console.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Console.dll
Size 26KB
SHA256 0fd96d98bf3a451878ae79b89552eef36dede2b08ba3ee3a276eb8cafef6504f
MD5 bbf400f3e3735a27d5fe587361364005
SHA1 77ca9fbdc1a319bab8406dc9d943b8354fd985b3
SHA512 491a37292973c72ab96e42e6cb0dd5578a1d6f0e83ae388dcf70cdd2153b2941df90275adc679c5c86968a3b537217acbb602a2a9c86d18016ec4dec7ba81e54
SSDEEP 384:+NLJHQGQ327uKCQaM4jzf/+ircC0254RIgPLq9MLaXO/4KeDtDv3j9sG8W/KWx:+lHuoircEil0rXNB3hX
TLSH
T1E8C25C09A7F1C62AEBBE0E743CB1A50512737A536D17FAAE54D804DE5C833C08A50BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Diagnostics.DiagnosticSource.dll
Size 51KB
SHA256 5b95f9d0044df1adef5e0543fd5d24c7c6343a48820b2bad57bae9fdade45cc3
MD5 8077f794ed34cf8ec3d573907dc7ff4c
SHA1 d37d95bf60263c9582b56bad71b3574d7e4e6b15
SHA512 f9a5bba4b8d5ded8dd4b467e3fb3c8e00dd42240ac29a2fffb0767c8198157cdc01075e5944cb273b11a1a43b12535b4c711362e3381693caf6239abd3a50168
SSDEEP 768:nK3UZabWRcFoxZo0zK8REA+pDRkkL3I5xGTjO/4UElTF1NJpP:XMJ0zSpDRgI/pFrJZ
TLSH
T19833492832ED4727CBEE1B7AF0F110154B77A65B6402F7855AC8A59A3967FC00930AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Diagnostics.Process.dll
Size 71KB
SHA256 a4520015e4192ea35123ea05f9962225cf901485037ee50ddda1945983c2afdb
MD5 8faf2035a3752e33ae90de5b513edd5f
SHA1 125fe509c8487e77ec39478ea3988de4a2448ce1
SHA512 2a32eb90e59b89673835b112f23dcae0e96fe3afe173549ae1dd8c78f42b1a3fbd790e43604f8985fc2285d84fe33aef0a59f4f2abfa9f2f47d67a41b2c71075
SSDEEP 1536:cIqfUpWKlRi6WQQf0ojj7J1cKnhfjb3d2lloOhohXmBa/C3:Hqq3iNf3jXDXfjb3IlloOhohXRK3
TLSH
T108636D1063EC8B1BEAEE0F7DB47051520BB71E171923EE9E5B949A9A0D077C14A217B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Formats.Asn1.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Formats.Asn1.dll
Size 51KB
SHA256 1509db510d905ddda6a1347fbf6f903533c084b228110be33d0c2fc2cc567da3
MD5 ad6779afdf68d62f593556f22f39b3d4
SHA1 1081cb4a716183be1904bca8b8fd364731fb4661
SHA512 2d3b2a4618fe4c8ef0c74429f1ce3aeb46525f7540157a6ff2af138a1f5d41f316a7210845079ae225694ec9369dd5819b24d600ba93d4348ea9db230202b89a
SSDEEP 1536:Iup7LGV5E/fWrEVvEgNGG4krZAucw4Q/GfevhY:gHE/E0vEgEG4krZAuT/GfKu
TLSH
T1A233E68DB4B88723ED8D873184F28C1585315157E2C2EB6E05D6E1E866037E39D8ADFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.FileSystem.DriveInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.IO.FileSystem.DriveInfo.dll
Size 10KB
SHA256 9f5c07c06e3a73af996120154f86978c2a8541941253b3c481f5c4c30fd9b7c6
MD5 668a3ae365044b337e2042addb811041
SHA1 a05d6f30bfca2edbacbf256c9dfe5817b25097cd
SHA512 98e263cfb438cb432784566a3be64f189e12cddbc6ff42926db71dfa74c766e3c9cc519f7b0bf9a10fda239eaaf87f490cf5e0f5e225d3c587844e00c9bcd329
SSDEEP 96:QszvqveBnjqhULxZvlwny+VQBiMQYGRjDJ9AeIZ5Ikbxvm5Jnvm0tcvSS9DmDVLl:/vq7U9bBcYGRj2xe580tcvSS3WfyWx
TLSH
T13B22E725A3F8C22EFEFB4B71DCB39544217239905C63DE1D86A5500F6CA6740DA63B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Linq.dll
Size 54KB
SHA256 3886f882f407454071d3eb961bb86bf98315b82e29875f386882f45f5e04bbd5
MD5 05e1153add376078701d7be106d8dacf
SHA1 6b866052ec2cbb0084f9cd634fa8116c657ae634
SHA512 1c8f80fc25b094eef8d6e9705b888a6aa55c0d525b7794ba3d283dec41c6284f0208f9098d74a6705736854100c83b692c2106d61f226b294c1548e287dff7ff
SSDEEP 768:IH3+YnV1Peu7v9tS3ukxaLW4xGpkoph5DFrhiQAURAgA2cQihrNCT3mCMhop8tGz:IH6uC3u9OrhlRvAR90z2GbC0
TLSH
T19143181930C98B23D7BF4AFBB1F201A796B59623960FE3894CDC6FE85C933414964276
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NameResolution.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Net.NameResolution.dll
Size 30KB
SHA256 3a7021c9c752fcfd81f643a967db907dca7c1afc41ea94ecd4e6d93ca6fa1fbb
MD5 3f234e8f4f768d97a9f11d31f64c24e8
SHA1 d6624316d108272a0950cac79ac356476ca2a959
SHA512 3613e65df009e5523d273a99c8b48e3699db59a620f0bb6b7a81921f6893a78cc562600a4034b3c8074f259f810f5f6ae6c3203c04878244f97a90f5d1fcd0db
SSDEEP 768:acP6AqAnXsv9v+Iq6NL6aFFJAYYAOlCt2:ac6BkXslv+X6N6Q5YAOwt2
TLSH
T152E25E10B3E89733EFEE0F3A6CF181482772A6554816EE5D288C635A5CF37C059627A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.NetworkInformation.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Net.NetworkInformation.dll
Size 28KB
SHA256 4d39ba98556fb38fc376118d8de281afda4336072591973c1875d33b3a401a19
MD5 bfcda991c140558f5a90277394536d97
SHA1 d0db6f139b672d82aa22ee8707817502822b35ff
SHA512 902e7fd1bec9fa53d1174eca50703821661ad0cc39b1ce5c1ea76d3f3f4203f9406d2d63ae70dbd0ccee561129a48a708fa57e698d62a55f45209c760ad862c3
SSDEEP 768:Km6nxyINnb51GX1My05iD443sqWKykqBaG:KBnxyINnlwFd0N48RKykRG
TLSH
T1FAD25C10E358233AC9DE073998E617950234A5806717EEAB15EC6AAF9DE3B811F21763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Primitives.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Net.Primitives.dll
Size 59KB
SHA256 073133bfb3e9c9d98275e83c9151a6343a0eccbf8bab68c3bee7f5e4768a4b25
MD5 5de83ab839e2688d9af6a7115f3e11c1
SHA1 df49e3f4a59f0cb469fbb78966f15e8f75446a08
SHA512 77dfb5fca2122bbed1ee81bfbb3b0a9cd1c77e945683dfc8af631bf2f9ef6e31f6cfbcc74699d54866c9a31a84c891d59d8b8cd25700053e2f9998fcbcd162e2
SSDEEP 1536:BgfBn7ahhmm3d+pWAzp0800FVyWWkgdc1:efB7aaw6WAzpd00FVyWKM
TLSH
T1E4537C40339C972BD7CD5F36B0B0A11407715A13AA0AEBB66DC9B5EA8D77BC449223D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Sockets.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Net.Sockets.dll
Size 78KB
SHA256 ac3bd8dbeb710a2b8f67d6fe3154020189e8765f30234720ceaeb52f3455373a
MD5 659f76db5e6fcda0bd27afeca914fa02
SHA1 bcb3c3f36b3111c393f931e1af7deba21212fe58
SHA512 1f11d5043f4a7177dfed0b1c9c7a6860e5e970f32ec610086f90e660e64d5e80935623d9fe3be75f81334dd60e32160a9664685fce1d13e558d83fa5ff9c1362
SSDEEP 1536:7vZcJjbfSOYT16/0pmKzrlFi53hvIi58huJgb5Dogsl8xEKx8Wxc8Led0FsYZPwO:/4XldS0WuPIY2bY39LJtu
TLSH
T1F9736C38A3FD4E2BE6BE07BCA8B01109227774A67A07F75AD94861ED58933C049517F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Private.CoreLib.dll
Size 2.0MB
SHA256 e1f23049796b69b10f82ebecc229390316e6169b1fbf7e0281bf56022240836c
MD5 50cc5a9ed596ef9e33549bd64234dd7d
SHA1 ec0d7e82e864f43b680cbe93cfe6ae9d22ac7932
SHA512 929baf17f59dff224b6098013329af584ce129d839b98d7a29cd5e51ebb5a53e136f32d2fa96a316f99f61cf714e334670c3f5738b407e65850d3eb0ca22c477
SSDEEP 24576:0rDbd0gc8bDf/wOBIVboX0nyLMcdnW5gqIfBhYRohOn0W:Mn/wOOSBnW5g
TLSH
T17CA58C507BEC8F3AF55F863994714B188BB6F8065B82EB566184E5FC5817B032D022FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Security.Cryptography.dll
Size 235KB
SHA256 335af57dab36ecdc9a2b6d07bdacbb6387fe77b57903ebb16b18fd3b379b97f7
MD5 e71b1012e7b6d1332ce300529339bcf3
SHA1 eddfa1cae408fccb615d2f8281c768c329226814
SHA512 a1b0f2bae2bd5d77f38219f766e76f6a000fc1af94b6bffcfe6b526d0aec115b2c10f677c32f7ad8c2e5b089a218239fa94000d1a5ec31683e8def95d3ad2c47
SSDEEP 6144:pTAaSltcs9ePK7mDGFE7F5ufpUW/WpirXx:pTxox7mDXFzAND
TLSH
T1A2348D1877E4CF2AF1DF0B35E031620E86BA944BEA5AF74E49C54CE41C537819A44EBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.RegularExpressions.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\System.Text.RegularExpressions.dll
Size 322KB
SHA256 d9027d39a75b4a69981b3a89e56e7e237e433059c70dbb700055594c8496b22d
MD5 d46b7aa4941112bae0291a58960886dd
SHA1 fe83cface8cfebabf7ced36719f98ec4c98a7b67
SHA512 7adc78f8cf6781bb373a0eb52fc1f46e10b9a8cc2d450e0cc2bdf53f88e392d9029089c024ffd89d8b7407ce7bc326be92536b9fa6ddc5764dfdb1453b209236
SSDEEP 6144:sNUl0V3OeoyLTa+YGbjdW9KVKDtL4A0cOvnHVdLfMX27:RA3OeoyLTa+YIk4A0Tvs2
TLSH
T1DB646A3C53BC2E26D3BFC333D160A498C7B6AC15F78EEA804C4470D919727A279695A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcolord.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\dllhost\hQnBl-R1cPxo\libcolord.dll
Size 116KB
SHA256 5a8cddcfbea6ac5ceea0d7660d92af1e01b791869fbf1562924439dc6b678374
MD5 1d729823cb1256af9a534bfa8149465a
SHA1 9569bf83e189a365593717cb6963b320f239b83a
SHA512 654d7bddd6db917ffc97c28d6e59d8dfb8e0672945ff32a5046bedb5d2bc651f3b14f3e26525bb7e3e65991e9bc975dc3d2a052bd2190aa81693c862375437b4
SSDEEP 3072:/w58uO3gnNx42fvcUhbN7SPjF1dD6wPvWiJFFG2lJ2ZomYQNa2dUTn:/630UhbVuF1ZPvWiI6J2
TLSH
T18CC3394473F98A15F2BE6FBE68B0005207B5B563A528DA9D1CE924CD1B72BC46900FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

colord.exe.crdownload

Path C:\Users\Admin\Downloads\colord.exe.crdownload
Size 13.8MB
SHA256 1c5ceda3080cb60d2d08e30a56c0615525b334a9577f296d7f201f23d1470ca6
MD5 991d0bb4f9bcb4fcb919ce63e39012f9
SHA1 6e1656636cb9a7baa06967ad0365243316f6e4f1
SHA512 c022d233ae28d8e1a3f57c00d17d9058d347ff74b23678bfd5a72df8cb1663eb30b94d9895d3f4c2781062a4b93911eaeede1e0016e927dde870e22c36af44e1
SSDEEP 196608:y8kG8D4HTaUhmY+lneVlFTEUGLCFJvhsm+/wOP5h:N8slwPGFTILCFJvh0/wOBh
TLSH
T131E6BF16B2FC02A9E5BFC278C5634617DBB278151320EBDF159096A81F33BD16E39362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

colord.exe.crdownload

Path C:\Users\Admin\Downloads\colord.exe.crdownload
Size 13.8MB
SHA256 1c5ceda3080cb60d2d08e30a56c0615525b334a9577f296d7f201f23d1470ca6
MD5 991d0bb4f9bcb4fcb919ce63e39012f9
SHA1 6e1656636cb9a7baa06967ad0365243316f6e4f1
SHA512 c022d233ae28d8e1a3f57c00d17d9058d347ff74b23678bfd5a72df8cb1663eb30b94d9895d3f4c2781062a4b93911eaeede1e0016e927dde870e22c36af44e1
SSDEEP 196608:y8kG8D4HTaUhmY+lneVlFTEUGLCFJvhsm+/wOP5h:N8slwPGFTILCFJvh0/wOBh
TLSH
T131E6BF16B2FC02A9E5BFC278C5634617DBB278151320EBDF159096A81F33BD16E39362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da836693-63d5-4060-b8a2-1db4b3975cec.tmp

Path C:\Users\Admin\Downloads\da836693-63d5-4060-b8a2-1db4b3975cec.tmp
Size 13.8MB
SHA256 1c5ceda3080cb60d2d08e30a56c0615525b334a9577f296d7f201f23d1470ca6
MD5 991d0bb4f9bcb4fcb919ce63e39012f9
SHA1 6e1656636cb9a7baa06967ad0365243316f6e4f1
SHA512 c022d233ae28d8e1a3f57c00d17d9058d347ff74b23678bfd5a72df8cb1663eb30b94d9895d3f4c2781062a4b93911eaeede1e0016e927dde870e22c36af44e1
SSDEEP 196608:y8kG8D4HTaUhmY+lneVlFTEUGLCFJvhsm+/wOP5h:N8slwPGFTILCFJvh0/wOBh
TLSH
T131E6BF16B2FC02A9E5BFC278C5634617DBB278151320EBDF159096A81F33BD16E39362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download