hxxps://cdn[.]discordapp[.]com/attachments/1562940129159544863/1563962738793914588/Loader[.]zip?ex=6ae620cd&is=6ae4cf4d&hm=158daf3885ff99108e5b975ea2367d289d798c71c5dfb4db478bfb1df2d07082&

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1562940129159544863/1563962738793914588/Loader.zip?ex=6ae620cd&is=6ae4cf4d&hm=158daf3885ff99108e5b975ea2367d289d798c71c5dfb4db478bfb1df2d07082&
Sample261030-ylvmcsfd97

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3004	Arcus.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
58	raw.githubusercontent.com
59	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3004	Arcus.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3100	msedge.exe
3040	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{12F2B32C-B97E-4D1F-A4B1-539D954AEF3B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0 = 54003100000000005e5daf9e10004c6f6164657200003e0009000400efbe5e5da99e5e5daf9e2e000000ef440200000007000000000000000000000000000000b95dd4004c006f006100640065007200000016000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000783116defe41dd0175b244500942dd015c093c6ca868dd0114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
4840	chrome.exe
4840	chrome.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe
3004	Arcus.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3004	Arcus.exe
3252	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe
Token: SeShutdownPrivilege	4840	chrome.exe
Token: SeCreatePagefilePrivilege	4840	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
2988	Loader.exe
3004	Arcus.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe
4840	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3004	Arcus.exe
3252	chrome.exe
3252	chrome.exe
3252	chrome.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4100	3284	msedge.exe	86
PID 3284 wrote to memory of 1816	3284	msedge.exe	87
PID 3284 wrote to memory of 3100	3284	msedge.exe	88
PID 3284 wrote to memory of 1816	3284	msedge.exe	87
PID 3284 wrote to memory of 1816	3284	msedge.exe	87
PID 3284 wrote to memory of 5080	3284	msedge.exe	89
PID 3284 wrote to memory of 5080	3284	msedge.exe	89
PID 3284 wrote to memory of 2256	3284	msedge.exe	90
PID 3284 wrote to memory of 4960	3284	msedge.exe	91
PID 3284 wrote to memory of 2256	3284	msedge.exe	90
PID 3284 wrote to memory of 2256	3284	msedge.exe	90
PID 3284 wrote to memory of 4960	3284	msedge.exe	91
PID 3284 wrote to memory of 4960	3284	msedge.exe	91
PID 3284 wrote to memory of 3288	3284	msedge.exe	93
PID 3284 wrote to memory of 3288	3284	msedge.exe	93
PID 3284 wrote to memory of 3288	3284	msedge.exe	93
PID 3284 wrote to memory of 2772	3284	msedge.exe	94
PID 3284 wrote to memory of 2772	3284	msedge.exe	94
PID 3284 wrote to memory of 2772	3284	msedge.exe	94
PID 3284 wrote to memory of 4068	3284	msedge.exe	98
PID 3284 wrote to memory of 4068	3284	msedge.exe	98
PID 3284 wrote to memory of 2816	3284	msedge.exe	99
PID 3284 wrote to memory of 2816	3284	msedge.exe	99
PID 3284 wrote to memory of 1824	3284	msedge.exe	100
PID 3284 wrote to memory of 5112	3284	msedge.exe	101
PID 3284 wrote to memory of 1824	3284	msedge.exe	100
PID 3284 wrote to memory of 5112	3284	msedge.exe	101
PID 3284 wrote to memory of 5112	3284	msedge.exe	101
PID 3284 wrote to memory of 1708	3284	msedge.exe	102
PID 3284 wrote to memory of 2744	3284	msedge.exe	106
PID 3284 wrote to memory of 2372	3284	msedge.exe	107
PID 3284 wrote to memory of 2372	3284	msedge.exe	107
PID 3284 wrote to memory of 2372	3284	msedge.exe	107
PID 3284 wrote to memory of 2740	3284	msedge.exe	108
PID 3284 wrote to memory of 2740	3284	msedge.exe	108
PID 3284 wrote to memory of 2740	3284	msedge.exe	108
PID 3284 wrote to memory of 2896	3284	msedge.exe	109
PID 2988 wrote to memory of 3400	2988	Loader.exe	123
PID 2988 wrote to memory of 3004	2988	Loader.exe	127
PID 4840 wrote to memory of 3976	4840	chrome.exe	130
PID 4840 wrote to memory of 4056	4840	chrome.exe	131
PID 4840 wrote to memory of 4056	4840	chrome.exe	131
PID 4840 wrote to memory of 3040	4840	chrome.exe	132
PID 4840 wrote to memory of 4068	4840	chrome.exe	133
PID 4840 wrote to memory of 4068	4840	chrome.exe	133
PID 4840 wrote to memory of 4356	4840	chrome.exe	134
PID 4840 wrote to memory of 2432	4840	chrome.exe	135
PID 4840 wrote to memory of 4356	4840	chrome.exe	134
PID 4840 wrote to memory of 2432	4840	chrome.exe	135
PID 4840 wrote to memory of 620	4840	chrome.exe	138
PID 4840 wrote to memory of 620	4840	chrome.exe	138
PID 4840 wrote to memory of 1612	4840	chrome.exe	139
PID 4840 wrote to memory of 1644	4840	chrome.exe	141
PID 4840 wrote to memory of 1644	4840	chrome.exe	141
PID 4840 wrote to memory of 3984	4840	chrome.exe	142
PID 4840 wrote to memory of 3984	4840	chrome.exe	142
PID 4840 wrote to memory of 2864	4840	chrome.exe	143
PID 4840 wrote to memory of 2864	4840	chrome.exe	143
PID 4840 wrote to memory of 3252	4840	chrome.exe	144
PID 4840 wrote to memory of 736	4840	chrome.exe	147
PID 4840 wrote to memory of 3004	4840	chrome.exe	148
PID 4840 wrote to memory of 4920	4840	chrome.exe	149

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1562940129159544863/1563962738793914588/Loader.zip?ex=6ae620cd&is=6ae4cf4d&hm=158daf3885ff99108e5b975ea2367d289d798c71c5dfb4db478bfb1df2d07082&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffcedffc188,0x7ffcedffc194,0x7ffcedffc1a0
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,17763434116454606300,8449784701210040525,262144 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,8719241038792448540,11551434590585604342,524288 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,16433960069117373966,6385928015263956531,524288 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,8900814038742688435,371880118748584107,2097152 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13611525888773274444,5199074314684405338,2097152 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,10813043486208175710,15916195316815725479,2097152 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,4443778838989392450,6569281546276082341,2097152 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,3155168549780627872,10968109394407602365,524288 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,5020821440553984687,18233998108199426793,524288 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,12367895474580285810,6312242269959868499,524288 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5712,i,2699872409625692266,699935012115152155,2097152 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15787623614255826500,4730648245206225853,524288 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,13225662488521542134,9654817292871277991,524288 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,13225662488521542134,9654817292871277991,524288 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6876,i,17073757873767943507,5400602966857940651,2097152 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5824,i,8050546190433384733,9466857250485076267,2097152 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,649207071414906645,17379001156258665907,524288 --field-trial-handle=2312,i,3511574269687544805,17263214482006854348,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:8
  2⤵
  PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5036

C:\Users\Admin\Downloads\Loader\Loader\Loader.exe
"C:\Users\Admin\Downloads\Loader\Loader\Loader.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SYSTEM32\tar.exe
  tar.exe -xf "C:\Users\Admin\Downloads\Loader\Loader\Arcus-Lite.zip.next" -C "C:\Users\Admin\Downloads\Loader\Loader\update.tmp"
  2⤵
  PID:3400
- C:\Users\Admin\Downloads\Loader\Loader\Arcus.exe
  "C:\Users\Admin\Downloads\Loader\Loader\Arcus.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffce017c728,0x7ffce017c734,0x7ffce017c740
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,425289679932400396,7639684821358262477,262144 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,13327665210430138175,16349630370115633676,524288 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,16491974513013630892,5319233416143272526,524288 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2200 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,8361926666041348608,1760932531194920717,2097152 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,999041244060416448,13084758355218159070,2097152 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,6653859116264021972,4118041281201613097,2097152 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,776735590780705883,13355658200710508720,524288 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5392,i,9595046327075765412,2452846117673201113,2097152 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3280,i,11512738487879829170,4714879441420286365,2097152 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3456,i,9636594568623201250,7067937273546759882,2097152 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,15132281126977446743,4261223217041994972,524288 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6020,i,15752104790111486280,11994894284105950344,524288 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,9125755219434424032,14163771816184379028,524288 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6024,i,18184706300400469136,6063195393700315742,524288 --field-trial-handle=1904,i,3622233980780099865,8978884691468897674,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7eebd15c-f183-4c06-9bc4-bda74cfc4dbf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7eebd15c-f183-4c06-9bc4-bda74cfc4dbf.tmp
Size 269KB
SHA256 8ad5ad7fd4cbde084e77abfb117fd49878a153f1c5216417794b3b6655a5f3c5
MD5 57b6f017497bf869650b30a5aea01438
SHA1 0dc82204e5e17b7e40ea894550d4f074e7f9326d
SHA512 0f0dbd82dd291faa84e9a2702858b542f60392d53e45e3a0fc692ff3b672494cdb89858836af6ad2b9cdfa55bf2dc1c84c30af18c556f32a5efc57a4d5ba50cc
SSDEEP 6144:wgDF7Q4IpKC6FXXiIpDqYGp88t+hFD+7t56OD9ZfSApprH:wkxQJp36B9ODpLyFSXD9ZfS49
TLSH
T13F4423319E508DBFCBF90940B1ABA300CD7695F9D49D7A984C423F86D1AECDA4762933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32d01a52-33a1-432f-8f21-6dad5ccad1b5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\32d01a52-33a1-432f-8f21-6dad5ccad1b5.tmp
Size 414B
SHA256 57cb2d96789ec80d3975ad87e81cad14ddeeed69d5abc42a99dd78c610367f31
MD5 cc5cca5a91aa84909e2affec9e5decf8
SHA1 6e628f09a159e8366034e4e16b037b80efb3046e
SHA512 08500d8b752c5cea69265b55793c22a1dfe1386257ae906fe8942c485b435865f858709e30a75f664f3d5f7572b27d6019b873e62775583621902d3411bfb89d
TLSH
T1B9E068A9C821EC7728FD079968644786F745139737C0984F3A3C920D8FF423A859AA2E
MD5 SHA1 SHA512 TLSH

Submit Download

3892e84b-f593-44bc-a0a4-9262748f80bf.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3892e84b-f593-44bc-a0a4-9262748f80bf.tmp
Size 13KB
SHA256 b528d4ec32fa3e79c650ac3b01b52b5bc841ffec17bbe71075d28bb6650164f1
MD5 60090477c616b53f4037ab15816e9261
SHA1 169e2474b8663d15812d6dd90980f431ef9a3691
SHA512 10fa3f99d75d6d4437ef24c6456c9f34349a03f3f6a34d0e34249978f7149dbb682ff616fccae00e7c745629bc6a349a995893ccd85ffe7949636ceb9eec84c4
SSDEEP 192:GZRYcBz+bbmv73pLPRpGUj8hE9vHsb+WNnTM740r03U29ZyQs2SPaOaVyIsnAUge:GZRYmz+/SbtXLhwwT32by32yaJe
TLSH
T1DE52A52AA920797B6DDBD22AF962B727E3F5102264D42EC4E6FCC93C24E75CC6117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38e86119-3876-476a-a499-80e8b93336fd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\38e86119-3876-476a-a499-80e8b93336fd.tmp
Size 12KB
SHA256 df788b2e504e53d73dd0252413434e265d808ad6f97e222580f6f40b13382259
MD5 09041c05287bc7bb4ed64bfc373c2f0e
SHA1 f925bff43046ac23751567de5371f412f82170e6
SHA512 9073c1f14e01b58a54818625c3b8e4a0b943ff8a8c9a46a7be7503c450fd6ddca23e01999f4412a7c4060bdf15a969e097bfce43d1487c171a2c4157b4161296
SSDEEP 192:GZRw+bbmv73pAPRp23Md9vHsb+WNnM740r22ZyQs2SPaOxVyIsnAUgtaJ:GZRw+/SbUXJhwMT2iy32yae8
TLSH
T1FF42942AAD20797B6DDBD22AE9627717D7F5102264D42EC4E6FCC93C24E75CC212740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

601ead2a-aeae-4d69-80c5-e6ef4798756f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\601ead2a-aeae-4d69-80c5-e6ef4798756f.tmp
Size 13KB
SHA256 687689c59bdf0e6abe16e4a60279987f18bc5634e3ba31adb911a06c14e72e8b
MD5 609062dd2ccd0a7465b16625eb343428
SHA1 2192fd3d4b801847c45824b5b499e9701a6e7e20
SHA512 08d6f060c1ce95c8676943cba0057bdf24864ac1f8e2a36bf6d4640e4d0498b9b2a03a4173972196cfd03d0e41a514002e964594e17009f763750f8281187469
SSDEEP 192:GZRYcBz+bbuv73pLPRpGUj8hE9vHsb+WNnTM740r03U29ZyQs2SPaOaVyIsnAUge:GZRYmz+/KbtXLhwwT32by32yaJe
TLSH
T16652A52AA920797B6DDBD22AF962B727D3F5102264D42EC4E6FCC93C25E75CC6117007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6726951c-3990-4495-9b8a-806958e1200c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6726951c-3990-4495-9b8a-806958e1200c.tmp
Size 12KB
SHA256 d48cbfd9f6eabfd7973eee47313b053841ccab5f6b2c13f0e026319a060b36fc
MD5 f626267c9916443b8f4548d32dd951a6
SHA1 9d677af46ff6644cfe5379caab26f72e1253bd6c
SHA512 973688f3e3773205172cec33c337a072ccfa8cfd2623e5e08d69d19526ebf9364180a147b3f4f15d9fc68104e747672ec64d06e69b74564ec327992187d12854
SSDEEP 192:GZRYcBz+bbmv73pAPRp238hE9vHsb+WNnTM740r22ZyQs2SPaOxVyIsnAUgtaJ:GZRYmz+/SbUXqhwwT2iy32yae8
TLSH
T10342842AA920797B6DDBD22AE9627727D3F5102264D42EC4E6FCC93C25E75CC212740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 0f8a0722302d1b8e1050f1c7882af2c0feb056752c3feddcc0b4316891d60d44
MD5 cffe89fe76f974f10f591767becdc8ea
SHA1 63d099b0fca6062bb726f3c8bbbc704a1611182d
SHA512 69a6672dde71770eef237d7bedfb1a82317a68339abd399505acf995dc2132b0ef4e4fbd36b8453c8b9556877ba778722662b901166c77ef2c38a8d88a0a8a3d
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqL:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEa
TLSH
T1E774230B2E1DCA322357475B503E382845454A294BCF27921B689BE8853C9FBBEF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 34KB
SHA256 c811b76785137c789ae1dd0f21ee61c40ee7eb76518b51e3c3fe6a32a606d92f
MD5 5591ff4b466999e32aec305d8474ac9e
SHA1 22e393341dcefff9d1d67520eb83688cb904ae1a
SHA512 04dcd2ebe34c90d7cf4e92800c4f69d7632bd45949f1c64a74256f627cc79c6ab0bf61adab871aeea10daee06e8d528c7002c39aba4f6a68b35e7aa4b03501b5
SSDEEP 768:gnBd63kaD1qJ9skOECPJ6K6LNJmuZEo1Vb:SBE0aDE7s4Y6bjp1F
TLSH
T1D4F202276B7F59F1263821E4251C30D17E3D2FE3D40114CAEE8CA58C53390926AEE966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 350KB
SHA256 9213695e49135b2b4210878deefb3175bda171b6b435beac015f402684e5ddd0
MD5 ec8b9b0c9f3c90635368e649421dfa07
SHA1 abe7ca6128a3b1b393c902eff3ed39605279cd9f
SHA512 2072062f4ed9d3a5f4d69ed6fa79c52c12336147b03b9e0258a61cfb7efa411ec230fc8c28f2dca7bb8253bc48ecfbc51a06083ae5433962dd0f85a56f96acb0
SSDEEP 6144:VatIoleCgd8D9UZrUqr3NI5bwvb8PgMvlYeUyPWzDL80niVq03XfEt:gl3G8DWiqru5bU2yeUueL80mXfy
TLSH
T132742317566A63A822A9DCAAFFF31F02D4EDC23150ACC45B412653BCD64E6933538F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 41KB
SHA256 504dae855be151f01ff5f0c36f628d136a3c742200a48c662f2af5bba1b8e6ce
MD5 24969bf67bf2d80cc21e9f5576384261
SHA1 735f4170613250382641d7beaacaafee63bf2c9a
SHA512 b3a4f2b77bffa695d536bb9b322d7152c85e2ce12ae9b37cf0fcf95b889d05bbb9e837ae91403340dd20a020541ffc46dd3a6d0f1ec58fa8d8937103bf8320de
SSDEEP 768:umYcJbJbpd3ek5xS+dOLJdsFo04VBdf1Cn0pAZVJvJV/o8nKHucmR0k6:uw9Tewo+dyJuFo0mtT2ZLJ9o8nCucmS9
TLSH
T1F6130242B1C3070B1C6E082489F995ED885E790AD11A72D34BB6EB7D5DCF313B285CAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 347b157e90994cc86873f99835ab3f759a4f07fabb642052aa560da05ed59cbb
MD5 91ed348409fb1fa5ba31d2377004f49b
SHA1 7f6bf9081ef1d2d4090501df181ce0aae36abdac
SHA512 4b22ff681e97696b00d17b995643ad522bedee68e391d9d0b7d8fb479cb1cb0fb4effe78af810a2d2f6381634fed64dda60d3218402a36abe3223f5b37093ea8
TLSH
T1932162A150BBD414EF1135BE7CDA09C4F02FFB2E811B5A5A28A0953B369E7A3600D06A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 a92bace739f699a9e40b4111fb5f3a83bbaea4fbcb23c9b6b4813b656240f3e8
MD5 b45af51b01599aeaaa242eadcc3a49eb
SHA1 834c04a2aee02fe0a6b902238f87e9c9b093313f
SHA512 324e4ca8d159fe4903e585f405c13e8c975f0ac47f77a8c1f00669cfbc03070a7ab338dc5d3fcbf22ebd1c4ad256a3967aadd2f6cf709b9abe7936b717619775
TLSH
T1A54154E180B6D104EF503A7A7CDA05D4F13FF729C1574F9A5490A57B326ABA6610D01B
MD5 SHA1 SHA512 TLSH

Submit Download

45b4e661-7c20-4392-b5b5-0a544214b6d0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\45b4e661-7c20-4392-b5b5-0a544214b6d0.tmp
Size 10KB
SHA256 59795dabff04c766c8add484a7233192b6be74679f9b3a6705af05ed246b70f8
MD5 3d0d3da26886db4103a419729c33fc92
SHA1 281a7645b5a942d246975eb5544e88445032b079
SHA512 547cb4f456dcc20858c47e886d0b7ce802197d26f58c8a5f3b4794feacf473454280d7fd41d88b266b0b36f21dadbee8d2e025aaca3bf3810e3fcc89786703cc
SSDEEP 192:Dna2jZYUakoTAedmWaIFE9vqmM7YWnoXNmhV95fZttToL3+3Jt:Dna2jZYUakoTAedmWaIFE9vqmM7YWnou
TLSH
T1DB2290B3C3D4CA7DC80166F4AB257E1FCD2A0928522D3D27C9E5EE4B53E2472E25124E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 a235a7c47d9ef2b045d3c641fed65a458f32ad7fc7eda6e047c39bd37d387f31
MD5 35cb7bca744a762bf5c944fa0253e436
SHA1 5ae9f31c349e86a1af3b51c77a8887ebe25b69c7
SHA512 946682443903f26839e20abe871567d370333216f3a30a5890f6ef2b6754572b79c8850fab57e08d552d1e45dc3dd075ae9984748c5aeade66889c70d95dd928
TLSH
T12FB01241C1867920C88085F03124308821028EB5C503130787E45E9EB8834D411F0200
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 deae65e18b2336add484ffe931e0c551430aaf24847ae3ac292659ba8f2c1bb8
MD5 8aa28934425b9d22f2783650cdbe54ea
SHA1 1f92f3820b6242be1fd545f0c041774edc99d04a
SHA512 8dda833f153d3d7327832745d06efe6446a9df7eac538d776615bb0cad3b0291143aead7759a3772b753dced1e2b9f8a0d50e2383be8fde960a3e781d2a53553
TLSH
T16DA002D001C80E15E1A44A75DAD255C133247A650B574F0156D9446E88741878121282
MD5 SHA1 SHA512 TLSH

Submit Download

d67476ca-74ec-46f0-8a4c-aed174ab9fda.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d67476ca-74ec-46f0-8a4c-aed174ab9fda.tmp
Size 13KB
SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
MD5 8607790a422ecb522e4c0dbd3b269b34
SHA1 e5c7ec8f685c74ebdd01a67f0e763209d8676d75
SHA512 27cdf461b3cdb01cf1d4a2f802f426248ba3f5fe8ed4c31dd046a71cdb0f38b25a10db78f318bacc40577b31c54a1cd046ec06e134194cc0934ab8961d501a55
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslHEXODDK+ErU3gbHGVQoiTCGY:ftDu7KxkXqKf/pUZNCgVLH2HfgsdWOHH
TLSH
T120521927A88C9A7F0FD4D98DDC176F4FACF501576568486852FB9C0803A6BCA114E2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 270KB
SHA256 b99ce8345f6a3487f563d1705f0f61425a1bb7de8e6935df6a31db8875911397
MD5 ff2aacd5615843104958962b1515c3ba
SHA1 353b0babbda721cbd92985067efd57a1a34faaca
SHA512 0dd362c67b87da5ba1f2c94a54d9b445d6790a9442592075f88c6da2ff37e7008c6a8feb7a7262839d89f1210a1f6f3f527254166f6a23fdf2d181fa45d02954
SSDEEP 6144:3jDF7Q4IpKC6FXXiIpDqYGp88t+hFD+7t56OD9ZfSApprH:vxQJp36B9ODpLyFSXD9ZfS49
TLSH
T1B5442331AE50CDBBCAF50A40B19BA300CD7696FBD49DB95C4C452F46D1ADCCA8762933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 732b7086ff76bab0832724683556c38dd1bc597f35cc5c43d7bdb3add3da1495
MD5 b1b47206288b279cfaa6c091bf73a0ce
SHA1 5b411ce2ba9c77065ef9290f1cbdbc96fad826c9
SHA512 749e32b5570b6d09d898bad53af2c39057c9206fcc5965133d3ce7f3bd943395c11a2d69bb608d8e7ae366ea85d3a5620a1825febc8e25b25e249edc17642922
SSDEEP 3072:N+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:N+hFD+7t56OD9ZfSApprZ
TLSH
T1DFD31232AA91C8BBC9FC6541B197A300DE666CED45DE3A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bae1ed2a-c35d-47a2-9aa9-513714a40d20.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\bae1ed2a-c35d-47a2-9aa9-513714a40d20.tmp
Size 269KB
SHA256 4bd16dccd6e244c21826a0d1776a8f642928a93899b61ecf7cf372c2ce4d889c
MD5 8365695bcf6a748009dc4e539a11b68a
SHA1 b9e7f0a94a928968a4ffa2ee98e9744b801476c6
SHA512 9d5b34a4e27d996595bb85581f7c6cdcf929e48dd716a61665dc55e9b0e4e522da427ed941c1b6ce4bc58a41b2327783d8989f256c9938f52948f9ae1f0c0976
SSDEEP 6144:TgDF7Q4IpKC6FXXiIpDqYGp88t+hFD+7t56OD9ZfSApprH:TkxQJp36B9ODpLyFSXD9ZfS49
TLSH
T17C4423319E508DBFCBF90940B1ABA300CD7595F9D49D79984C423F86D1AECCA4762933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3d2dfb4-e368-43be-a926-e909e9f6d701.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\f3d2dfb4-e368-43be-a926-e909e9f6d701.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1b1e34ec-913e-49cb-989d-0b7699811983.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1b1e34ec-913e-49cb-989d-0b7699811983.tmp
Size 18KB
SHA256 6762bf05aadc373bdfa72f66a140e518191a66bf57e3884877eb31b910a42089
MD5 5d6c31d84cd5e88c730bab9461e6e15a
SHA1 f8895749bedd1f78384640723738faff030403e5
SHA512 20a77f951d5fd884f5f3efe1b0915ce1d243e74c2b33a01a12c0d110010e8d49467f7ceb173af328f9b7b5d455bbf404babe77caf9c09001ae4d8b61bef85a33
SSDEEP 384:GQkUSvqsN1awMXiX2OjTV92OqG7YjfG2IGMtUBIIlj:mq6XNnWO0jfG5jUBLl
TLSH
T1BE827C31A8782C7799F6A540F48E3203CFB88197D6941FA4D5EC6F2C05DB2DC234B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90398dbc-c8f7-44cc-adcc-285e6071a485.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\90398dbc-c8f7-44cc-adcc-285e6071a485.tmp
Size 22KB
SHA256 12b09a98cbeea1c35ee4d5cda773db9a7c75be66a4ee86a00ea4f55d323320ed
MD5 fcebcfa6f7b728142d9ca9435d431190
SHA1 dbda4e748d3ab40c8c6d6964d340f540142e77c5
SHA512 eb7dd78d30e01a559a8ca36de8dcea0ab0935d7ec28a4d3ceadd295f96603709dd4e2d52fecc6d1770f65b6244ad692013440a90e5a3d05738e7953a28dfb3a4
SSDEEP 384:NQkUSvNsN12wMItX2OjTV92OqG7YjArVvFA8Bnt7onAMKwIr+z2IGMtUBIIlj:3N0XNnWO0jAx68QndKwIr+z5jUBLl
TLSH
T1FFA24A75D8A46CF744A6E1C0A58AE103AEA84177D6881F5CD1FDBE3C30CF2F82356952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8647040-1571-4d5b-aa48-5aa092f8b50a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e8647040-1571-4d5b-aa48-5aa092f8b50a.tmp
Size 105KB
SHA256 98d027a7d5f34317602446091fe5e8214f7e942ff9ef737ba4d84e1e3d5595bf
MD5 8f3342292c3866482651f7779a119225
SHA1 4913b3a3b3dbc7ed6a23f06a3e43a7fb771af8a5
SHA512 5ac909173ab373dd81244ae41107fd57459d8168297be5c68fdfbbe0e0d6bba188b269540254cf5084284313bf648a5ee3587eb3073c307b59f64cfeafed06a7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7J:fwUQC5VwBIiElEd2K57P7J
TLSH
T125B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6896424a5a3b381b45d285b4cf70ce7e98f33f311d36d19d8d3b3ce510d1fb4f
MD5 0f416c8861efd339d5180f12f5c81c0a
SHA1 34c85e241e2f5f4626ed5826171c2f0f05e68ec8
SHA512 cbf250ad342a0353aed2853b94687d52ccac9cef58d857a8e044f825113708d40d3087d248724d9c0cac9d60ad41fefdc7a127351677073192f4123030ebcfb1
TLSH
T1BAD0807479163DEDC1DE70B5113499C04394DF238101151916530D181D743933851DD8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

087372f2-2b19-4076-9df4-ec737755e257.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\087372f2-2b19-4076-9df4-ec737755e257.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4908c9aa-3747-4c4c-8c92-e284940d293b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4908c9aa-3747-4c4c-8c92-e284940d293b.tmp
Size 9KB
SHA256 2f357f2fec1f4eab24df567b7eab2d34e0977125535b95a360e40f1deb4ed6b2
MD5 e5e1fb683430dc4b86a7e8b66d340c3e
SHA1 2a75aa068bddd2eb2cfce46ca3ec80796e4177f1
SHA512 5498b5740f36a0164937fc63adc05c2201a4b9260e9b7e9289ef08dd00b46c6cb5e23e2a2411f6415b29b3106ab48de2185b8b10c717f4437f3f171d0e814831
SSDEEP 192:sxZRPRGnz/fMsWPIdpJHW6+WNGYRPJUdfIgrJ:sxZhmz/fMsWgJHbGm89
TLSH
T19412CA126E38A57B8CCBE20DBA59BF53D6F9503291D51E98EAFC861C04E66CD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ce65845-78d5-4e25-a9bf-c28a25d50566.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ce65845-78d5-4e25-a9bf-c28a25d50566.tmp
Size 10KB
SHA256 6903a644d4d2ad90f1ceb1ff4602b185a1ba8df5f077a2512c6e039036d106ff
MD5 0b0b115fe67b3a1266958feb41d43cb7
SHA1 4a08fa14d6bbc203e4e3ab0d004f099f5265e9a0
SHA512 26accdfb3c30894d65f58fc595fdf90758afdcfc05c6292c20e23431cda80c8dffa3572b21eee61af170d35b91ca4ac715d83422c8f3e43b27f4badb93164957
SSDEEP 192:sxZRPRCnz/fMsiWpVQPIdpJHW6+WNGYRPT7RRIgFJ:sxZhCz/fMsiWvQgJHbGmzv
TLSH
T17E22B9116E28A57B8CC7D21DFA697F53D6F9103251D11E98E6FC8A1C05E66DD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0ea452de40afc456e560b2cfa89b1d89fd886f24a9a075368d0274c44595bcee
MD5 5b2e7391d9dba69327c0aa2fbe5504e9
SHA1 aac9128066c9ed19096a737c9c3f961f8830de2d
SHA512 158f85e23a2ad2440e35cdd396b3e1039468f3f2fec10825f488424c0b6bbe8787787d6a7990dccaff22e3da119b818f3c45077fce0a8a62041a62fd490eeded
TLSH
T1C16170F778ABA4D1F7A8A1BCAAD210D3B6B774A019673C0D1BB0DF39988E7185004093
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a48992f978d429d4cc2fb2fffd22a01aced034cc0d55fcbfdb815c3457ce3a8d
MD5 6299fdecd0ab52b0423bea135fd03cb4
SHA1 d4c213c0fd78b810f26815e7820171c6abb28588
SHA512 be4f815bfff7ac75543eb141bf9e59afcf063fd898abdd7183c3e623c8d2dc0f5ca4be008e0be83b210466f239314bb87678aaebb7f9ca2eb1db33aec3a4eff4
TLSH
T1FA6171F7786BA4D1F7A8A1BCABD610D7B5B7749019673C0E1B74DF39988E7185004093
MD5 SHA1 SHA512 TLSH

Submit Download

f1f30e3a-ce07-4442-b931-b8a1a3280f23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f1f30e3a-ce07-4442-b931-b8a1a3280f23.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2f9f5513-dd32-4077-a53a-987946f426fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2f9f5513-dd32-4077-a53a-987946f426fd.tmp
Size 1KB
SHA256 46a283618bf970c48ee463d7e1057bbd8de162aec7f8fd453d6097f1e0a27a68
MD5 86afc5f30704cab304c97bb837119cc5
SHA1 38bbf489cc316b6d2c13354b349d5e2afd54ae54
SHA512 b7b6ba1e2c4a8d6d4097d440e4f4024cbf851b625ed503f96e27c3fe8b20084ea5c19fd555cef51627ee5ad0c5a370de06f817922f9663b37d17839140b4e93a
TLSH
T1552197B3C7D58A6EC90146F46A246E2BCE6D090542693C2AC9E4EF6BD7E3472E101D4F
MD5 SHA1 SHA512 TLSH

Submit Download

bf20688b-363a-4677-8035-976d9a0bfeb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bf20688b-363a-4677-8035-976d9a0bfeb1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b0acc7ac460d34b45c6cd9f904a62afed12d81cf8604b907b72b38cfa954267c
MD5 6ba98b66d3e35b5a60e5c087cc358334
SHA1 913edfa2f38ccf41c5f69f07554cf4ed244cb1ad
SHA512 b1004659304e2be316fe66ae969cd7741bc56bbfa4bd05dba8e4da3801f190c344127e20cc48a2185449eec4c019cf5537ec7feacc014d51735e5f3ac7bf54f8
SSDEEP 96:K0mFzKKkcmbOPCugYY+uohlQO+K4LQE+MGOp0FtyKOMl:XZbOPCugYYdoh+OOLQERGOp0cE
TLSH
T1CE91101032AB164139BD294881B5C61F625231F33068E66FBFBD61F64E6BE040DFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c38038db-c61f-43a4-a2fa-acfa424194a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c38038db-c61f-43a4-a2fa-acfa424194a6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8805263-5c4b-4ce9-8378-48d87ab4d4c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8805263-5c4b-4ce9-8378-48d87ab4d4c1.tmp
Size 27KB
SHA256 d4276e78842cf630d0d69809f3cadd7db9f016fbc9e615e0d0538e70b1052060
MD5 0b585870f7ef3efe3142972ea37e3186
SHA1 d4a02fbc8ce5fa1628add49266f53b052643d049
SHA512 617aa6839d98ff00f74ae9b483024ca2d0acae15b74e42bf27318a6094a30b285458cdea496291c2a135aa6b762fc45688b057b9b41bfda1ff34265278b008d4
SSDEEP 768:JxK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3+roe+Zc:JxK9uzYWvcQWsu1ja0HL7Q3Ve+Zc
TLSH
T17EC2F93F640CCB7E5FC01A9DDC5A6F972E9802D7A6588D4047FA984C02C77EE522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

d95e368e-0b36-486c-b304-61cf77b8fe5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d95e368e-0b36-486c-b304-61cf77b8fe5c.tmp
Size 8KB
SHA256 d9e9e0fa754b0709d56078185bd1ba5c5e8bec094c857e8a9e9b8d9de56f1da0
MD5 70405d571d8bd85003e3889b92b71347
SHA1 357833c8b8d50b7501f94b38925c7ffd8d3ab6cc
SHA512 127c8e933099fb1854f92823eadb176ecc12e6cd8244d9c899eb7bf29643e7966325fe7fd769899cc8880e3fc1a76d925787b5945db0ad97cef74ead803150e2
SSDEEP 192:gONw6yrQmiUyysECOCTVg+2OqR07YjpF3U7qZU6:gONw6CXCOCTV92OqG7YjsGU6
TLSH
T14C120935B8386C776DA2A541F48B3213DFA84167DA452FD0D5EC1E1C05EF6AC230BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eadc557d-108e-40b2-a64e-41bf5228c2e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eadc557d-108e-40b2-a64e-41bf5228c2e7.tmp
Size 8KB
SHA256 9731caa0ff005a50b216e0314fe8b67506870eb0e17a2fce3dbcf2069f2bfe2c
MD5 f0d610d4af4394205e3c538b28b4cf65
SHA1 508c2c3306b257d023ed44949bcf15aa69c065b3
SHA512 a8883e699feb765a17c1bdf562b2533a8f6263c0f3402e988217950cf2d4bbca6dfad986ed6b0458ede75c940c58243cf52f533d11a342a4979b881a5af457eb
SSDEEP 192:SON66ygpQmiUyesEtOCTVg+2OqR0BzPfNU6:SON66lHVtOCTV92OqGNlU6
TLSH
T17602D634B8686CB79EB3AE46F48B36139FA8116BE9512F84D9E81E1C01D765C2306C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c402782d621a7937388c86f11b343bf41d9dc7744f6d8176f2817e4709a228f4
MD5 d24c3084fb9f799ae136f71d8561b786
SHA1 2bd3d5ca93861193db5c8d2c3bf9ffdc89fa8977
SHA512 67a009079fd980dd2a071e29972cec438eb42ad2d7e61367ee4e4a496961827ee67971526e9fe399238416f5639bc14fe14d6d9cca570fb59e2c7afdf1ea8f91
TLSH
T157411798B6F92108B3B36F56AFF7A86E447BBC772E06D56D10010E4F0662A00CDA1733
MD5 SHA1 SHA512 TLSH

Submit Download

99f9c527-3966-4265-9458-91af28d41fd7.tmp

Path C:\Users\Admin\Downloads\99f9c527-3966-4265-9458-91af28d41fd7.tmp
Size 11KB
SHA256 8bef7c567607eba9d15e4083839830893fc0827eb415163dab606dc7169d528b
MD5 4b12874805490eadf4bb1587222e1783
SHA1 c36c18ed0bd143a4d2b32c89d7ace70486155bb9
SHA512 ed04fdd4581ccd98a4e7b21a3e7c0c5a8805264133484927621d0581b84a7afd31a132575cf7c83e4be583fbad564c313e6ecca84f3216f2a3aa6dc6ff2fa422
SSDEEP 192:zhfW9hwGOIMtXkNGmAfiFtw82+Dan41yCjm4oWl89CkM2+wwjzN5SKgHrnNCYCYQ:zhf6hwGHMKjoiFtLpo5CDPsrur
TLSH
T10C42C0A1F5DC4894CC09B57E3AED31EF236E72DA9840FEB2C139D35BA0E40471698841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Loader.zip.crdownload

Path C:\Users\Admin\Downloads\Loader.zip.crdownload
Size 203KB
SHA256 92575a913fb537454b0bb3669be7a62368ed25a0278dbbd9258de84919d877a8
MD5 3cf74e68ee2f6a4deb111aa5e6e472ca
SHA1 23ee9652fa8c8924a5fd36c97603f346b2fef8b3
SHA512 38d95f5f2b755813df7480afc80eb1c53e0b706f84ad52e82a2edf6e6a8a538b4c112fc6ce8cdfc8644ca24ed87d08a625e3997296057bc76a9210e70b969dae
SSDEEP 3072:tf6Lb8cA4rcNT2FyhwfrnFP8s0mAtxStthwqKh09eK/RMoqp5Za7voj58wxyYEnv:ts8cBckyaN8iAtott3Bv/RMDrZl8wIs4
TLSH
T16E142399A6B0FCCDA1035036D29E37E17A2F29ADC4C1F0242E25615945FFB76E205AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Arcus-Lite.zip.next

Path C:\Users\Admin\Downloads\Loader\Loader\Arcus-Lite.zip.next
Size 9.8MB
SHA256 cf4df931cdac8e5df8ecf5eca41ca2655f4d2faa5e4d1a10aceec60dc1189874
MD5 a6f9ee223d12e223b4758eb71170c044
SHA1 ab05a08872e8d95925e4066a0ef576122da72923
SHA512 27e412c8c2f85108fc2403349e8d3e2cd8f4a159fd1c9998973e568269d383d2535b287867669e46b500aa1aa232e8c8231e3901c54be5e9ca79de36411e46b7
SSDEEP 196608:E2Y+ky+nz5+OYyD6w0HpeRV1DR680zENiD46LxBME2E:Hky+zr8NHMRb2ND4IsE
TLSH
T1A4A6333DDB917AF2E45307F2A427021531E48391E3568BE8A02DEB9BC17BB277855F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Arcus.exe

Path C:\Users\Admin\Downloads\Loader\Loader\update.tmp\Arcus.exe
Size 15.5MB
SHA256 be9c9ea81a32e368af04f1256ae5b6a6cd062548e6ee76d082d010350219554f
MD5 0b44615a8b42733f51d3216523cb8009
SHA1 9827a708618017cf35831f2f4c1c66c945202182
SHA512 9e3380eb2849798f42122c380b57451335adf206dd17692100d3f6b7b6679bf4dacc917dfd5ee906791b8bf4899ae693bc9e32874b7e9066330854da6ee0ecd1
SSDEEP 196608:dzRVDwvK5pi4g7PAmkgOUZqL107RFZ/rgSOnfcSeL4m6cPknfcSeL4:BwiniRPAmkgOPL1Q99OnnsPknn
TLSH
T15DF6E072F39199E8C53684748D02A703EE713C8B072056DB779C7A6A6FB36D05E39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download