57cdf62f476b4dad0fba13fd89364d74342ac35ea5b703def833a4c6d70dee73

user interaction
yes
max time kernel
112s
max time network
114s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 13:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
button.css
Size 730B
Sample261107-qj441sys3n
SHA256 57cdf62f476b4dad0fba13fd89364d74342ac35ea5b703def833a4c6d70dee73
MD5 f0bda0c29346e0cf17377614cd55e48c
SHA1 4777f4e2877a2187544de690ad9efa8f240c11e7
SHA512 7a6004259ca2d4346f35648759ae3dec18d05dab4cc91641706e7ee01124b5132fbfefb9a4910ce6545c870a8b046b354367889aa1b617434eb455297e2cdd46
TLSH
T11F019C68DB05844CB81780D467D21BC557BAC123FC02683A9AFC54B1CFDA0F892936A5
MD5 SHA1 SHA512 TLSH

Score

5^/10

discovery execution ransomware

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	bootim.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	bootim.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4776	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4072	msedge.exe
468	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "130"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4077919521-2131189092-3796306753-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4077919521-2131189092-3796306753-1000\{0F0518C2-163F-4C09-A7F0-48CE84257556}	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4848	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5080	OptionalFeatures.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe
Token: SeShutdownPrivilege	4588	chrome.exe
Token: SeCreatePagefilePrivilege	4588	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
996	helppane.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe
4588	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
996	helppane.exe
996	helppane.exe
3028	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4848	4776	cmd.exe	81
PID 996 wrote to memory of 2984	996	helppane.exe	84
PID 2984 wrote to memory of 3040	2984	msedge.exe	85
PID 2984 wrote to memory of 788	2984	msedge.exe	87
PID 2984 wrote to memory of 4072	2984	msedge.exe	86
PID 2984 wrote to memory of 788	2984	msedge.exe	87
PID 2984 wrote to memory of 788	2984	msedge.exe	87
PID 2984 wrote to memory of 2404	2984	msedge.exe	88
PID 2984 wrote to memory of 2404	2984	msedge.exe	88
PID 2984 wrote to memory of 2284	2984	msedge.exe	90
PID 2984 wrote to memory of 2284	2984	msedge.exe	90
PID 2984 wrote to memory of 2284	2984	msedge.exe	90
PID 2984 wrote to memory of 2408	2984	msedge.exe	91
PID 2984 wrote to memory of 2408	2984	msedge.exe	91
PID 2984 wrote to memory of 2408	2984	msedge.exe	91
PID 2984 wrote to memory of 2852	2984	msedge.exe	95
PID 2984 wrote to memory of 2852	2984	msedge.exe	95
PID 2984 wrote to memory of 2852	2984	msedge.exe	95
PID 2984 wrote to memory of 2312	2984	msedge.exe	94
PID 2984 wrote to memory of 2312	2984	msedge.exe	94
PID 2984 wrote to memory of 2312	2984	msedge.exe	94
PID 996 wrote to memory of 1776	996	helppane.exe	97
PID 2984 wrote to memory of 2224	2984	msedge.exe	96
PID 2984 wrote to memory of 2224	2984	msedge.exe	96
PID 2984 wrote to memory of 2224	2984	msedge.exe	96
PID 2984 wrote to memory of 2320	2984	msedge.exe	93
PID 2984 wrote to memory of 2320	2984	msedge.exe	93
PID 2984 wrote to memory of 2320	2984	msedge.exe	93
PID 2984 wrote to memory of 3372	2984	msedge.exe	98
PID 2984 wrote to memory of 3372	2984	msedge.exe	98
PID 2984 wrote to memory of 3372	2984	msedge.exe	98
PID 2984 wrote to memory of 2356	2984	msedge.exe	99
PID 2984 wrote to memory of 2356	2984	msedge.exe	99
PID 2984 wrote to memory of 5024	2984	msedge.exe	101
PID 2984 wrote to memory of 5024	2984	msedge.exe	101
PID 2984 wrote to memory of 2948	2984	msedge.exe	102
PID 2984 wrote to memory of 2948	2984	msedge.exe	102
PID 2984 wrote to memory of 2948	2984	msedge.exe	102
PID 2984 wrote to memory of 4040	2984	msedge.exe	103
PID 2984 wrote to memory of 3028	2984	msedge.exe	104
PID 2984 wrote to memory of 4040	2984	msedge.exe	103
PID 2984 wrote to memory of 3028	2984	msedge.exe	104
PID 2984 wrote to memory of 2840	2984	msedge.exe	105
PID 2984 wrote to memory of 2840	2984	msedge.exe	105
PID 2984 wrote to memory of 2840	2984	msedge.exe	105
PID 4588 wrote to memory of 4444	4588	chrome.exe	108
PID 4588 wrote to memory of 4188	4588	chrome.exe	109
PID 4588 wrote to memory of 4188	4588	chrome.exe	109
PID 4588 wrote to memory of 468	4588	chrome.exe	110
PID 4588 wrote to memory of 3908	4588	chrome.exe	111
PID 4588 wrote to memory of 3908	4588	chrome.exe	111
PID 4588 wrote to memory of 2408	4588	chrome.exe	112
PID 4588 wrote to memory of 3320	4588	chrome.exe	113
PID 4588 wrote to memory of 2408	4588	chrome.exe	112
PID 4588 wrote to memory of 3320	4588	chrome.exe	113
PID 4588 wrote to memory of 2868	4588	chrome.exe	115
PID 4588 wrote to memory of 2868	4588	chrome.exe	115
PID 4588 wrote to memory of 4068	4588	chrome.exe	116
PID 4588 wrote to memory of 2284	4588	chrome.exe	118
PID 4588 wrote to memory of 2284	4588	chrome.exe	118
PID 4588 wrote to memory of 3400	4588	chrome.exe	119
PID 4588 wrote to memory of 3400	4588	chrome.exe	119
PID 4588 wrote to memory of 3256	4588	chrome.exe	120
PID 4588 wrote to memory of 3256	4588	chrome.exe	120

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\button.css
1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\button.css
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4848

C:\Windows\system32\OptionalFeatures.exe
"C:\Windows\system32\OptionalFeatures.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5080

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=517009
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff9d642c188,0x7ff9d642c194,0x7ff9d642c1a0
    3⤵
    PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,536609327083837333,18386828148147633728,524288 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,14907769197882759594,17263399751096076697,262144 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,2781638200417804095,4665956984104163253,524288 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,3088915900703077970,8834662943442455462,2097152 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,14193791233503214915,17706447940056759589,2097152 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,6122172058794303710,8122759448196630092,2097152 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4220,i,14311755707692670673,12096930886121501633,2097152 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
    3⤵
    PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,114422982136662125,8223896228281159649,2097152 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4196,i,4977893488358723402,965368798200793820,2097152 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4876,i,1908925260311945055,17431971935336240216,2097152 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,10547041393539858458,5906788796615440350,524288 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,9212721075679444533,8352682670973392816,524288 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:14
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4008,i,6159668897603297427,2113913920507732742,2097152 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,1513795734408929128,14523290277122576147,524288 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,10876986507905605208,11408737456012289457,524288 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6148,i,12830442757924359337,10552261887305206995,2097152 --field-trial-handle=2204,i,8805905303602466956,3844877809212650191,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
    3⤵
    PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=517009
  2⤵
  PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c601c728,0x7ff9c601c734,0x7ff9c601c740
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,17828164336592217690,6139197078902332491,262144 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1484,i,10921654590001306182,2065232843658116745,524288 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2408,i,8801566243113196888,2554586877961660146,524288 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2420 /prefetch:13
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3320,i,12683193029500302375,15631589893187135309,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,13627987857490810924,4285809728034819047,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4612,i,17375170705745474934,8192454790276618539,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5372,i,1822284428764978001,8110823874975222980,524288 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5376 /prefetch:14
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5700,i,18068535032865810743,16183581851507881417,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3668,i,14988023615617054049,11115108219218311634,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3636,i,16281424182382601843,4731973192207941754,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3984,i,9998042527181337006,14826173024426522191,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5560,i,11050249961030869758,1972794248063610128,524288 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5680,i,540464504611700542,6933370979275873503,524288 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5632 /prefetch:12
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3664,i,5122911568416078658,3086448748676225513,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3500,i,13278288718899851299,15156516865606473577,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6212,i,11704532151387436102,1111934105750943962,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6364,i,1024077485681469978,5019563518219267027,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6104,i,14941381074510016707,514735067603784449,2097152 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6420,i,14675356870141359264,16026213509888613434,524288 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:5728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6424,i,16307088110031917271,9442349218261342595,524288 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:5736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6068,i,7587962205727800578,13833514751440340639,524288 --field-trial-handle=2064,i,10677264665577555398,4067164089744693784,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:5748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5376

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a36855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3028

C:\Windows\system32\bootim.exe
bootim.exe /startpage:1
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1095b16c-0924-40da-b282-dafa29685ec1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1095b16c-0924-40da-b282-dafa29685ec1.tmp
Size 274KB
SHA256 152de26611bcae50120671b79e1d4105e40c4ad94664c17ab8f7e766c822e077
MD5 4fdb929092777ea15a7542e5dfb1900c
SHA1 4b67e212e6ccdf1cd7d675630c09b4f67030b722
SHA512 88710fbcac8c87a4852f08249276006ffc2670d81c956dda3ca044e7c21565df73fae85d31a2ba705a91801a1fa6b78abbff36e6aa1bfaf5895db3129143bca5
SSDEEP 6144:a5zYai8IcGlvfGnV2gYnG2t4fLJ0L6nGJxi3bzqapJjV:a5fIcGFGV6nG2WXUx8zvpJp
TLSH
T1D65422F19580694ECB7FC94846F62D988DF068CB49CDF92446D8AE09438FB369F05E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ff36e4b-0e14-4c01-9cb2-016d5f6834f8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3ff36e4b-0e14-4c01-9cb2-016d5f6834f8.tmp
Size 130KB
SHA256 61e8670533fde043a8e0b8d69b20ce26be29fe6d3f825fbccda9590d4b0e8c47
MD5 a9729c70f8b469fccc9805423970f720
SHA1 d8e3334b75bc710580ba324ca9c9620da3451e4f
SHA512 71dc1b961c48a742bee8f28f9c9956a97a7cbbce6ef753ab2f90bf523e96359fd7daed75a20bb0febeb819ac79f12f20c7f5ec3d514787b78bda208acf9bd95f
SSDEEP 3072:sH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjv:Ut4fLJ0L6nGJxi3bzqapJjv
TLSH
T140D302F0C6E06C7ACBB7EE8145755E948F71D5C689CDBE2005ED8C18068EA740E17EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4da9f7c4-7efa-44e2-923b-4707b5b1584f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4da9f7c4-7efa-44e2-923b-4707b5b1584f.tmp
Size 274KB
SHA256 c046ad3f2b0bf130b7452d8d3abc5aebf558631977339f184f9eab99c9c127aa
MD5 2f6c4acaa521f413a53d91a79d436865
SHA1 cb9f201a8683727e71bc172a9d29064ab1ecd5fd
SHA512 7f193c1960a5601474732c146ed48ead8d8dc387c3067a5ea6cd35d95415222dbe508f54ef5bf253f5a40894db02c0c01556c826f5e9b0f84399f53e3c88decf
SSDEEP 6144:D5zYai8IcGlvfGnV2gYnG2t4fLJ0L6nGJxi3bzqapJjV:D5fIcGFGV6nG2WXUx8zvpJp
TLSH
T1245422F19580694ECB7FC94846F62D988DF068CB49CDF92446D8AE09438FB369F05E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f41b0e1-27fd-439d-9d50-5090c225bc09.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\6f41b0e1-27fd-439d-9d50-5090c225bc09.tmp
Size 275KB
SHA256 cf970652ae7242ce17c1e050413fce8afad25290156c041cecba2b7113a23744
MD5 bab22fc2a8e9a7b7f5ef403b2a3e2b8a
SHA1 e36549242fb2ec7aae13f4da2261ea82bbc9a271
SHA512 396d07eec83c5ab3b56ebe05cf1dae4fb037e00724f6a43229500321747af7ee9941d13f13e117766af433b014f4ec8ec0880f1e2a1ee585b4e7b9ec8285bf1d
SSDEEP 6144:vq5zYai8IcGlvfGnV2gYnG2t4fLJ0L6nGJxi3bzqapJjV:y5fIcGFGV6nG2WXUx8zvpJp
TLSH
T1A35412F19580694ACF7BC94806F63D948CF07ACB49CDF92455D8AD08528FB3A8F06E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99673206-348c-4d6e-b6e6-39302f93ac8d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\99673206-348c-4d6e-b6e6-39302f93ac8d.tmp
Size 274KB
SHA256 bc218058ce9871cf2202d34991877a4b5a17d0fce492b3172e8e090e9cece6b9
MD5 c5ffa39927d478b29e5ed138cfd69c73
SHA1 d56b36d5e9933d3a251ad7fc39b1fa74284f4527
SHA512 8e3319f12961f0662efb1d84fbf688a5903fc01543722709709449cd82bf38349c68ea0796fc95ebf8f90f5feab70842cbe18725cbbcdc9c1c0e4a2066f961cb
SSDEEP 6144:O5zYai8IcGlvfGnV2gYnG2t4fLJ0L6nGJxi3bzqapJjV:O5fIcGFGV6nG2WXUx8zvpJp
TLSH
T1675422F19580694ECB7FC94846F62D988DF068CB49CDF92046D8AE09438FB369F05E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02d182ac-9309-4c4b-a3be-df41b9d80251.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\02d182ac-9309-4c4b-a3be-df41b9d80251.tmp
Size 13KB
SHA256 183080ab87b58b695e03979ec4d826a874606e28a558a00578c46ede242e7bf3
MD5 39a15f899b72a397b11f40acfbc1cab5
SHA1 54ea4d4be93f1b6a15ebebef9ff229a0e0838199
SHA512 ae62798f9b7b81e80405e993f6a7544bedbadc35071157fe0803ce0777504d53675849ce53ae3c5baed5676cd4fd0e8f6fd749ac3f569ce5cb24b1aa748ea364
SSDEEP 384:FPjxk7KxkXqKf/pUZNCgVLH2Hfgsli2XODxM+ErU3ucHG4YiBknjE:F7xk7KxkXqKf/pUZNCgVLH2HfgsgcOdJ
TLSH
T13752F827684C9A7F4FC8CA8DE8536F4FADF50147A168093856FB9C0903957CE124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dcd2078-f451-49b2-a425-2c712ac69b10.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4dcd2078-f451-49b2-a425-2c712ac69b10.tmp
Size 14KB
SHA256 16e5940d31fb319746446d571120822920fa04473f024b128eadffd3c6d3bcc8
MD5 46f2b41b3d36b90f62ac9f0771655546
SHA1 59e6bc21771837d641e4dfad54d570ddf3ea6fb7
SHA512 ed79ba803f6dfbf7356ae30e6a33ae776d780ca299b6459a0694a00eac9e6d472d4dc68a1e765e7fd152cd34b95a963ea37b74933e6ee0c15545edc3e73d28f0
SSDEEP 192:yRP9cBzG+fRlUl2v7m3hXPRprS3hH4t4q9mHsb+WNL5zTauW+rDe2k5w2G0SqVyr:yRP9mzG+fElCa3lXPgwZSKe/5w2Gpqe
TLSH
T12E62C82AAD10697B6DEBD22AF9517F5BD3F5102264952EC4A7FC8D3C14E7ACC2207407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66709078-f63d-4934-a920-f676951da09a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\66709078-f63d-4934-a920-f676951da09a.tmp
Size 12KB
SHA256 9f80bcf1711d106b0d34b15fb166ca7c4d91a359e6c4112f076f89727956f02c
MD5 d48a2ea303ffcafaed40ba2c12261e83
SHA1 87403ccb08fca21ab9c2544aa59c3cd99f2c5bc2
SHA512 9aca8c69adf68933d733d884f9f481042da6fefd4ac7afd8f0b08d2ae8b292159e47a68e66a2f27e1e058293c79b70bc110404a4a47a9b9708539920946f4390
SSDEEP 192:yRP9cBzG+fRFl2v7A3hAPRp29qa9mHsb+WNnzT7cY2ik5w2G0hnVyIsnAUgtaJ:yRP9mzG+fLlCk38XSgw/b2r5w2GEB8
TLSH
T1F042A42DBD20797B6CDBC22AF9627B57D3F6102660952EC4E6F8883C14E79CC221741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d9c2b3f-62c1-4209-8cf7-e3c2c8dda937.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9d9c2b3f-62c1-4209-8cf7-e3c2c8dda937.tmp
Size 12KB
SHA256 2cfc70ae6021e9bc33fa47fed901e7685662165f481a724abddd3cf88f8ed874
MD5 02645895dc5fb3398cc0750eebce87ba
SHA1 13c94eb38e42c7b4ccb0e80c5e0f19c9c5f3e757
SHA512 d1753fc8459fa102167cc2348a237262a4ee67e706fc0ae3b7d99bfbca18681715a470b0b8337b6a3202a393205cddbba5c776ab2368c797a43e623ea44b30b9
SSDEEP 192:yRP9cBzG+fRlUl2v7m3hAPRp2SsH4Uq9mHsb+WNnzT7rDe/k5w2G0hnVyIsnAUg8:yRP9mzG+fElCa38Xngw/TeM5w2GEB8
TLSH
T1CC52C72ABD10797B6DDBC22AF9617B5BD3F61025A4952EC4E6FC883C14E79CC221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000037
Size 60KB
SHA256 cc973d3269d0c35a0fb1d3a28893fee8b6bb61c494f4cc62ba058f2d4d01b49b
MD5 91f9cfa3b4fce852f06d306bb3109cad
SHA1 f2ca0852c643d6e7ca421ce6002396e4aec8de75
SHA512 96aa3c4b8808407c756c402605a33b6fed221b1b63eb07669614192a904d1017c576eba2879a40aaba649fa5c4dc5fdda23173afe9d2ad88f640e09e5e3f4c93
SSDEEP 1536:6BxVIy/97xKvP31ypRUozFoqmwjfz772qG2:Ub9MvP31YXGqfz77lG2
TLSH
T1F85302922A6135F5F517CCD51E58203BFD3529D9D6E42438C3BF4B989AE24D38D0606B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003a
Size 51KB
SHA256 93be3c85aaa5ee0195989b628703a6513dc0530f4c82c7420c84bd0baa8d10ba
MD5 ddb8fd0a4175cab934f589ecb85aa9e3
SHA1 ccbe794a47b6c42a22050dddebe0edc5e1f05cf5
SHA512 b8aa1f47a71fe6622b6feeba02bae68cf4b10d6e0ddbd39fe8cc5dccf55a165ff84ff5da5dc45e9a9aadfb40ee5acfe0003c5c076a858694de15ffdd3392c3be
SSDEEP 1536:9/MVJ9SWlPXNi0dUzQ4xzb/raafY6zIXVtvZI6:9/gJ939iGqQ4xzaaQ6zIlthB
TLSH
T11C33F1CABE2983384DD52490D2D05BC776881AF3549B76C6566CF5B2CB0C79E4441227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 8819a41358dc5f899f35702acf5e02211e7c1cf0ee2edfb9c9371ad0cd29db6b
MD5 e2f7df584615af3ef34c77e0fc78dd9e
SHA1 e862f161d3eb891f557215479c7ad457e4b138e8
SHA512 7e7caeeefefd41ace5cce0c758180da2a385a5af5194ddd1cf059aa5045944a5b1f40b13199b4b40fc1c53fb9a7dada045d00ed01830e3aee36c865c2331dd96
TLSH
T15B410C22D79C0140FFB62A3D7B906F15F86D8964C8722B9B445DB0E09D12BF900D51C8
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

27f0d4b3-fef4-431a-a39b-02701823d219.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\27f0d4b3-fef4-431a-a39b-02701823d219.tmp
Size 1KB
SHA256 75dd61a9f26975f540a74d77e37e662b234f639ba6e35c96be8920fde2e8805d
MD5 2dc13bca0c35cd620d71cdb102ad56a2
SHA1 75a8d96a438f78169a24945de13c1cebc89428be
SHA512 100d006d85a1a79d483adb05a4b97f967fa9e69cf10099fd5bb58bebd97bd0cee74902859f72972008327dfa19e04932fe626ab5b52e9964f69e005671e51023
TLSH
T107416DB7C77FB86B503E58AF1F847C0A6A7EA831829170F8DA97923D70C18F71A12051
MD5 SHA1 SHA512 TLSH

Submit Download

d10936df-77a3-41f0-8e49-8d35b96a9f68.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\d10936df-77a3-41f0-8e49-8d35b96a9f68.tmp
Size 11KB
SHA256 bc645cdc980c527f186057241e11d7c4960f0df2f548347aeeb5c243777526b9
MD5 49fe133099c3605baab3d0f794aed031
SHA1 5a5bc364abf5d157b4ea9a4c2aa460e24872b82a
SHA512 242f2f767717bd9492ae87e34044cd9acabf3360268cc5f731fa91bdba3920d359f93ed8ec7eb0adabe25c714bc37563e55b3679b826f14f2e1aa37e0101e77c
SSDEEP 192:Dhs51UE92JJJJv2BLaIA+SahK3isSXUHuQIZN2aP2+vLfPRl76NP+fImlNe4i5/X:Dhs51UE92JJJJv2BLaIA+SahK3isSXUl
TLSH
T119429CF7C3E8862DC81156F4AB156E1FCE2E1A68432C3C26C9D5AE1B93E24B1D25174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 137B
SHA256 a20ec8f0ee3be054e4561f1a71d0a09d3bb49b434e6e7540f8416ced2627ea0f
MD5 b3559e443cbd365b678e3c633aa2def6
SHA1 144c65563f171b3a7052f32f4c1944eefc0b7ab3
SHA512 0a6b025daf34591496c7b02fcdca445bbf844a0b0159ca3a88d324d77e6cf179615a06ef508b2b6376f7dfd65ac79a9d33052d8f331c0c6a8bb5d197bd8903d3
TLSH
T1F6C08CE32620818A0B2067811038620D901A9C6888C0C8E8A009700A20388038401A20
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 130B
SHA256 fa7ccfbd12dc854efa807400437575b516735e9e61b668ed14735dc9a8f79bd0
MD5 4d8210935df7c6e591861e78c228d117
SHA1 b0a6f5cc131664371d9ba0a0f8a2d7a07f05085f
SHA512 d9cb7340f75de5c11c007a2660c032704cae27305be7b8ccd7a0838c69b7e73630742f2dcd979b88a815714ecdd50a45b4a2b8ee7b0d00330e4a2e6b33dfc9f3
TLSH
T17FC048E76A64868B4A74AB89202C621EA55A95A888E4C8E8A108A04A65799268812A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 214B
SHA256 1b1c86380451f44c147399363d1db139cfd8db522086ebe3c276f6233b6d3f1f
MD5 f22d64ff068d98359c138dbace8bd8f6
SHA1 5ee95cf8125545b92987584478b367ff129313b1
SHA512 a6ac0ef739c103e9457c22e9b7e0726f5ad1cae0cd8527427e2977742b90d633b6a0a7f842050b78fdc4ffcf0f8b87607c4e23ea60c17a03eee6abf4f6f88115
TLSH
T19CD0A9EAA37189872624AB86202C620E902AAC29CCD4C8A8A408B04B30B8912C802A21
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 efb43fcfbddd43cfa12f7e8aa6ca9b7374f236ab6b6b2befd937cb90acb03117
MD5 22a278ad5bdbad7b853f8773ac38869e
SHA1 2b3e554ce68440a9c832371f1dd75a35f100aaf8
SHA512 7abaab0301ab2053ea7848f6032ba93cec9cddd7b1975d57897bed13cc6298faa59eb8931a04a25fc40ddcce836b4d433a260dfcc49690aeac9d6550cffe6c2f
TLSH
T159B01200C05A5A41C80146702E8A146423144E32C0015312CBE155CD8CD33E122D0141
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 b0ee8019b03709200e15e8b12c439bc6bd1120489047d8cf83df394fc60bee4c
MD5 c241cf5d824533a5d6ff4c61716bccbe
SHA1 b5ad4168db5d020577bdd2e4fa387d2b5d7eab7b
SHA512 f4372f33023e6483b5ddf2eced9e04c358b554baedf078412d810ddf70648d8115c5cbd1251272f2f94408662e7475d3ba7f3d93c6691cbe5c0dcfc15ab69db5
TLSH
T1FFB0222800083203EC0083B3A2C0A8C0333C0CB00B03238280F000CCA023BEFC332300
MD5 SHA1 SHA512 TLSH

Submit Download

16.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome\16.png
Size 257B
SHA256 d52376c8b210b8003f5aed9f4555a7916b4640d4c42a36cc81d9864991c87a8b
MD5 6cc922565abd761f4039c816d86018c4
SHA1 05393c91529467f8ddec22a121fe482701365d6f
SHA512 8732f24ea85ab3fa845b3cfa2a354a85cab63a507947fb61bd8119c623e31c87d6f0735ce7f06119db597ec4fce4ad44c15046859b574cb11fb1306e489cf995
TLSH
T1ADD095F2E311DD34C52E96900533C473F433171B1DD56055664491DA4D9E90533C8D59
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons Maskable\192.png
Size 2KB
SHA256 e38c817644be45d52a86cbd54bbb93d6a8eb48f235247336f634d99833ba6236
MD5 5da9741a0c59eb94fdb2294873d36c93
SHA1 edbdd46c522579b44f3feab65fceb75f8cabe108
SHA512 cae22d835be04790cd3ec818c33f17d7f79aeeb18f3dffa4e013cbd93c848e098d5c865579538d0b8ef5e85d696ec0474d3d35c65465e00039886fc3b9d76f7f
TLSH
T11D5160528E43A48F95D61189AD0AD395283FA9F772989E400DD0487C4BB1F72F0BE4C1
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons Maskable\512.png
Size 7KB
SHA256 5cf3c46ba4fb97d3c33a2f0fb6fcf21e80f806b0efaa37d4c0b093fb5d06b515
MD5 8c3ebdba674edb75ac6e781b49b385f0
SHA1 3e675d9c54ca020fe7024011c26672dded81ffee
SHA512 13cd044f3e07d507a4638db1e1c768eeaf27e8eb9dfe6ab89ff1c7f8466b948813a9842ecbb150a3dd4331a796d60eb43b13d2c0c351769641aafb22b38ca066
SSDEEP 192:1RK1l8wmf7eYldMKJjx/hUZkEzvJkwGLA:DFWUDTZPEzGZLA
TLSH
T117F14A4C6AD084E556A8D24F8036C4D646D849DAEEEF9FA1708090ED2E3B71ACE74F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons Monochrome\32.png
Size 414B
SHA256 9ab81c6c525db346f436b28dedbd230871b83e44b3d1cbbb3799060302d6f5be
MD5 0e75ba937761d9ac2cf74fe8cfb7ddae
SHA1 00d57da0fdb6e82f5fea7d8bb2e4da16647bf33e
SHA512 4d52759c3063b3ee921cb5ce44a7f49d27b2aaba83fb03decb6d7f06da4325c59be6d40d63d9adeb9af93e2481ca747e7bfbe1cee5303d6e4729f5645ffb8c53
TLSH
T100E0ABCADB1AB83AE6859A121C108589A89A0318221900AC8381EA6161D89AE6732D8B
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons Monochrome\48.png
Size 639B
SHA256 bac87bfc14cff248df502005c077fec30abb6b71e4874860b5fbca615d55e06c
MD5 1bdc03ed18a0e29d48da13da101ba676
SHA1 04b1fae9ae2e96cbf6c680e09ae95307c764199a
SHA512 0459c71d7c6b6758f76cce2d8651a6bf052dbe8e4802386fbd0cd75866e5d3dc7bfbe4d55eb4889a3e6a15755cf20591948c84aa3ffc16dbf18e447f1e765c0b
TLSH
T194F0681657963CFB8D90017CE772607ED4B751B62134816623DC5CAD610D459582134D
MD5 SHA1 SHA512 TLSH

Submit Download

512.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons Monochrome\512.png
Size 6KB
SHA256 61348deb0a5da1f8e5cae8f1fb05653fd95c4eadc0c9628dd392afe36bff53b4
MD5 ae9c961523761367f8b19321afd804d8
SHA1 4cd4285023417ed969358f0a1442885658574618
SHA512 30b8972d89e3694b15a530b1fdec38683ab5d0bf0bae3e37c92995b6397b8d497ac789e4b1d1c5cc33281ec4b7a025428393097380e41ca20c47e35dae1869fd
SSDEEP 96:qGPhZydBAJqpBAhc3BJ50l0EHdV8fPWI8XeaYWzI/sL2c28H7fPk:gqkBdRJ50lPdSb8OaYWc/sLXbE
TLSH
T121D13AE3B22FDA41706A53B2CD43CEE1BE539695C745021A29EC567C84800A97CBAF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons\128.png
Size 4KB
SHA256 41b1a4ae8496e6638ccb3b0272f2005eab76f90e56d29f48866dab38fc7df8c1
MD5 84f2b6869b9c60a182b77688c26f9838
SHA1 f9f2d89e83e3aed40f3e78ec47a905acebdc37d6
SHA512 c801e4fd6d38f08243ffb0b69e961288cc6ac1e84fdd0163acb16ea59530299784b7e082633942365e561fab41a4813ad335c44470c1c809f2ca066c2556ffb8
SSDEEP 96:o+33PzSQ75aBw18MppNU8AtQR+eQoSBQK73i5Y/1OIAF8Kr3Clbd7e5h7bYJ:o+33PJaBwlppNUFGciLEyaNOIrUkRav4
TLSH
T1D0916EB6691BAC05F9A7ABD7D17942EF0CEBAA80C704CF152C5D166437081E3A3B63D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

144.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons\144.png
Size 2KB
SHA256 5dc5e3a8c0c0b0ea564b1c378500077947988315fa64b25f62ebd55253de5659
MD5 8045398ad785fc11c7a9d5a42e0661d1
SHA1 7c9b07ccf79011949524d9e4b7f1908894d6dbec
SHA512 ee6757fc7cda9f0b8aaf085811ec254818a474adb72014b171d08d8bf0413511aff17d579d8cc7948b64462881759a4bf2fcfd58bfaee57249e3805e57aa2a46
TLSH
T18951F98297E55619DE63713A0222C904E962CA34E1A9D7E3247449EDB68C6CE8773445
MD5 SHA1 SHA512 TLSH

Submit Download

192.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons\192.png
Size 3KB
SHA256 5e80189d5743f0028efeac0b3df337266d6805a8d1f0f215f5dfb422ea223d4e
MD5 e234001453fc4adc6364522c236465af
SHA1 97d1b03a486084a51ebbd91d7395ea9c2c170daf
SHA512 2a847abcd37b1c94d8524d4bcfa46d38a50efc4d5b979b16aca45ae1c320377e44e1fc23009afa137bb744d4e95c0f998417f85e96aa927fc08de44f7d828fed
TLSH
T11E612A332A8725CDC1B6CBA6473D4C03547E504AA279E54A9EC8ECFC277694053CB7BA
MD5 SHA1 SHA512 TLSH

Submit Download

256.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons\256.png
Size 10KB
SHA256 5aec5c9ee2a69c0c3eaf9b23258b18e0c7f1e16f35387bec76061239a8fae04b
MD5 4e6b37b3b74156e6390915cb572bc37e
SHA1 47843dda50e6f2a6396630748b6db2ded41c9463
SHA512 2d913faeb2ac0067308bb845d850bbe2d2d4406069d3841987090bd0c1163d1395be8fd127171640783832efe7f96813ca48e67a0d990a110ab465b068a7366c
SSDEEP 192:ZEEEd4EwKtFFYRHWE+rhfQHQYGdjm0+AqQtmw5NvFgoNriGMkua0SEEE6:w4OFFY1WEUrfdjmnNiaoIxU
TLSH
T1ED22AEB073A1578FE1DFB3CD9F07CD14AC2875A884D7AE96AA95E1E19A08509D00EF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons\32.png
Size 1KB
SHA256 bf77e0c65df7ce83532308d1acbf333098e1f4089672b67a9514a56144b1f1d8
MD5 ec856287ecbd2b1742659ffb05190088
SHA1 9c1ddd95b78d8ab154c85c57b5f89e7d7c39c7d5
SHA512 791f2f64ae67bb5798b249f55a966769c2cfccc21388cc17f6a41254649fc7f4c7c61a23fa3ad4920f2fef3e2acffd0ced7f1bb407736a0f1f2cf9c18bef8b4a
TLSH
T1641160C3EAC399B0E9FA232F6BB101B42402E429A7540908D878EC359A24A19A2DC2D1
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons\48.png
Size 1KB
SHA256 148a4e02b72a9fd908a6b2fba36bc2f5101c747d0b3167bb29608c9d6d3e643b
MD5 26ef2d3ec2906fb06f431e4ad0f0883f
SHA1 c7f3c3e2abdfc40ff64b1185400ad00dc7db53f3
SHA512 8fadd9090320de5820e5a323c6b0ccca899d062c061945589992827ae26c587c21fed2a3100b70b20e665d1b5d70479ed0efeffda867e37b21f875fea2ab5389
TLSH
T1F0312AF7AA3D5DF02E440562B8CBB798E1248ED9C2677026681F331509DF2900725FC0
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons\64.png
Size 2KB
SHA256 1d14c6cc14f6adca1d761b639adac4519b078766ec4d5872f4a4d3384c69162f
MD5 a5938c289204eb6828b69966640ff454
SHA1 169905d2da57cb1b0203df14553323ab45c10f57
SHA512 4c21be815bc7d8466d034e14e14c3a820c4681e9607a76cbdf889ec1b939e4ceecd1e90bf5dac38138fb7c646f35a8445d2306cab3a2c809ab5eaf5172b6e405
TLSH
T143413A2FA615D572D996E085B89C1AD1DC920B2F71F168052E67F401AD29EC938CE842
MD5 SHA1 SHA512 TLSH

Submit Download

96.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir4588_538801589\Icons\96.png
Size 3KB
SHA256 aadcc8084bbb970accd15979e1512a992e64f3169a44d911c44100bd63b13e3f
MD5 992c01e537191cb57b74dc0e33b9f30e
SHA1 9aafda8fba4ee601696e0371f32ad78ecaea45e9
SHA512 017a6c48021caf2d270e45292322c976ddc2f78f778d5d0f853deae067820f40b0fa619286c873a988b8395358ebe1a023f23ce6519ec70656c73bf2516d8b5b
TLSH
T13D613CFDC0A5BD2EC13FD5B18EB09544FD10805B76CB434BF89544A67842B690D7E24D
MD5 SHA1 SHA512 TLSH

Submit Download

c95190fd-eb5b-4bc0-aa8f-c38237d1b329.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c95190fd-eb5b-4bc0-aa8f-c38237d1b329.tmp
Size 414B
SHA256 d37510ef4f3d69eb660b5d918ce6fa3d0acc9b68f3db9d98d73524995a367c54
MD5 0abe6f411c2ab294383856cc4e1c1710
SHA1 b0c7bcd5d0184468d25dce1b4f8a198f64fd1bdc
SHA512 f1df5fd1b11c5a8f07ab8588f0282839c9b14b832bbe7c97a9ec4afde9afad2b811ec4f66f9025ffa24b551cd53490acae012d49bf53340fa779d41762bd6b1f
TLSH
T147E02BAAD820EC3728FD0B6C556407CBEA1013576A40968F3F3C91084FB1B7B01C585C
MD5 SHA1 SHA512 TLSH

Submit Download

1041e3a1-b6d3-470e-bdd5-1e53ed3a1645.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1041e3a1-b6d3-470e-bdd5-1e53ed3a1645.tmp
Size 16KB
SHA256 3d8507c7feb9fa7ecacf8fe86af6622d87b5ea6d6891413a337f97482f02a8da
MD5 2fa65a3d9b3d2bc59d1dee6b509cb017
SHA1 56842ab303649b1ad83b92b34f9e2aebbca487fe
SHA512 35fabaf5865fc8e696b11f6e4fcfbc3cc2852307a4e05793ca38878a5b8c80d79ef47e969b4caff4c7091ef6db3a16f001ca35076c51463678cc29fce8160cd9
SSDEEP 384:zR8N6N0LSKKzHIZ/5tyQCRNoKiR7VbKbdTrwuKL:94YzoZ/5zwNiDKbdTrwui
TLSH
T13272E87C9C646C3F99AFBB09B10E3A278EA4517BD5B41D58CBD81B0DC0B7588F342522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1427ae22-2b28-409e-8b61-8318d7f2268f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1427ae22-2b28-409e-8b61-8318d7f2268f.tmp
Size 8KB
SHA256 076fd4fdc4fedf113487c3a805558c8f95666de7310eee61e75becdaac93c2a7
MD5 46738d7279ebfb0ffc1afee232432b62
SHA1 3db2c157833180b0450b773fd7476d2eccae3c61
SHA512 a5b83f9f1c8482d1cca782703c7836c1ce6b06576ed56892823db5f95d08d4ba26018f491e7ca0e77ad9cd1bf7dab935506b5db30af466c9714aed2bd7a170da
SSDEEP 192:yGNj6QhLtQmiUywfOVZ/5P1yQh2FtR6/Jrqmv/U6:yGNj68LrNOVZ/5tyQCuz/U6
TLSH
T1AF121A747868EC375DE7A455F08737A39EA4207BDE845F55D9D82F2C01DB6882B0B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7fea82b248f2281dbde6cfd4855e94ad664119e19bce8e928d8e79096990cee9
MD5 d70e1174988e085ec70532acd121d585
SHA1 4263d0461b117a0a280c23d3b60a1289d63e25f9
SHA512 b7f76a92e8e277f9e25d28913399ab97e1271337f335327968418e9b9d80ee262217c5f19c8e811bd52488edd763fef04256c2d873008b4d6963eb9f0499b9a3
TLSH
T19BD022308222AAC0C0A0303E0B22002200E0BAA282A20B002888880C8CFC0C308A0B80
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9ffa5510bd8eaf647858e337946c3d8551cbdca3d5f58e2d47ed03bf6e04f43
MD5 e2b553a32003f2a232e334c2a7862a8e
SHA1 cac2df4649aee9c08574409d20cc837c1704412b
SHA512 fbd8879ece0c87ceb91747877c9eac2e13992e2df5094b3111703cdd532dce0e6df3dc8256243b2dd5219343938dad7b5cf8c47bc1e74c37ca7dc731914ba4a7
TLSH
T143D02230E3820C80C8C0303A2F338AB300E0FC20C0AB0F000CE8A00CACCCACB0A38300
MD5 SHA1 SHA512 TLSH

Submit Download

39c3187c-6520-4c15-8a7e-fc337f7362ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39c3187c-6520-4c15-8a7e-fc337f7362ed.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

502604f8-a80d-492a-9ce7-fd81c0cd21ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\502604f8-a80d-492a-9ce7-fd81c0cd21ed.tmp
Size 28KB
SHA256 93cdf14050e44fd481f4d934459d857513333efe89d9f2766b4bbf17759eafe9
MD5 8670eb8d89d5ae946448a9b758688c8a
SHA1 f8dbf3bd0616c604da130293712e8cd305c16583
SHA512 1f2f405b1ecb63d266b7ac66a9ff550e9a9bfd037e3895093ab8523d21c66173404e66bfb154055d0353b321ad328bba6d4302af3a9b3c42a5a9229a89ac75fb
SSDEEP 768:FpbN98wh2jYWRmYQQOs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV39HLl/eA0ZqmrojU:FpbN98wh2jYWRmYQQOsu1jaK9HLpehZV
TLSH
T1D0D21B3B240CCB7E4FC01AADDD566F976EA802D7A6648D4047FE894C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56a52ebf-7916-4dc5-86b0-df297c020ecd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56a52ebf-7916-4dc5-86b0-df297c020ecd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5cba7171-5c10-4751-b872-3994fdf811d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cba7171-5c10-4751-b872-3994fdf811d9.tmp
Size 10KB
SHA256 31ceb6b0060434ba15db87d3434b2c697c45d14fcfb36cfe2918265dbfd944e5
MD5 b45afb899073c7eea8eb1f8d19c48760
SHA1 65bc1bc81cad54d1cd76ff003da28852153c93a2
SHA512 80432ea4c4d51477410e4695e93431552e373c300cd58d7845a8340dfa39b0b70d6b45fc0321eff6283c993fec3dce3f812d987dc29a4e9daeaeb3733177f644
SSDEEP 192:zZ7RDCA/f9sdWpVY+EdpMdE/W6+WN0fmdfYf7RtaPIgEJ:zZ74A/f9sdWvYBt/bPfe6I
TLSH
T10332B612AE38683B8CC7D21DFA25BF53D6F9102695D51E48E6FC891C05EBADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000059

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
Size 26KB
SHA256 cc2853775b4dffdeb2728b700914c9c578b4f3877b8535d0a47c7068cc6506dc
MD5 0b07cdbb4f8f38142c9452781166b915
SHA1 1d62182c1478c1199ffcbd49077aeaf9e848b82d
SHA512 5eef6ada3907b11e2379f493b7ec8674ed223993bbde9cef4217b3a14c4ee5c09f026cdcc80ac28062be530e2400e4bf2619ae94352be920f114bcb6c4f32eaa
SSDEEP 768:Wn2+4khDqQ31uCuuR7LCqvhdhuKcz9vux1V+lhz:zkhDHuYn1pdhNcxC1V+l9
TLSH
T1DBC2F1552DCBFC7EC1E24CB3EEB65D595888A0ECF5AD9B2CB82839036DCC51551E00D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
Size 29KB
SHA256 87453a5db1ed8224f7c45e4870c1ae8c575aa0b446c15579c33aa5fd5853c1d8
MD5 01b482a62d261c9feb29ba156f69a1c8
SHA1 c62e2257f7085a669296121d00b9e2fe6520584a
SHA512 6da82754547f8029cac835d766c84bd41611bfa3757eed8f0207e7e55a8c43adf07986e8d3bae8aa0f8cda5b80f511e0f8d09c3bf075c31308cd693a1ded1389
SSDEEP 768:3Hu7a41iz4z9W51qDZmVIxcU0MZnPcTRdbQSgqJil:3vJzk9FDnOU0g0Tgjqa
TLSH
T1C1D2E187A12F488E172E1AF414A1E983F9D00D9D72C9A39E794B34ACE19E452790F59C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
Size 22KB
SHA256 62bc3de30eaa7aae0ccfe93db2dfc7205361af45d21f708eb44ce2667a866800
MD5 70859d2290c788ae775d8b77fa284be9
SHA1 518f3ff1cd7548644a4dbab7a8fc988a04a93d9e
SHA512 3df22441ceacaf003e00090282e3d82947d1971f733a78ba0622d089b89fa0da88119f3953a2c924baabb345d12cc00e230fe19fd2b066a42f92d4908d37b409
SSDEEP 384:TxFQO7PvwrMPDBbiK/cCIKhDqblHE/2xlmoIVx74pQ5vaI01LWGIXBdtf0mWVRb:TxFQRoPleKE5KME/Gm0uSBQTBdtf0nvb
TLSH
T1BCA2D1AD8B9004DCB63B1F8BD901ECD484684884D8B76E9E664F4F11D392E6E671B71C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 19KB
SHA256 64ffb2fac2cb915023a9009fb21f0e200164b9c3e92ec39180c41f4167abcc68
MD5 2dcdeb3a76135812ff2f821d8cd15c03
SHA1 f9707a7e0778dad6f4b99271e15935f5b07d99e1
SHA512 5206a5ff3281ccb5b7cb79494ab0fbee40281f7dea08a5a23e0733f3267d07465d5c1e908aa241f48653854faf042c8ba5332fe035b9e0e4f4abe75d7cc8a138
SSDEEP 384:qMJVMorHQ7t498bd/VExaLu58KiStk/ObzraH60z9Jra:lJmorw7+8hlPKiSvbK3z9Ba
TLSH
T13292D01E8938E59D961A3DB0A3D3E0B355C933DEF9354B1AC22687873F04998CA6611F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 32KB
SHA256 d772c10f31f389e025bc14c0440ea297a25d8def8e22e876774f55c67bebfa69
MD5 e21ceac49de4dcc316ba89255d9051a6
SHA1 9d98a8ccefc29a8eb8214ee896a60ccbc0b5a708
SHA512 1c0f9349c8637f311aeb7a40f4f58a96051a30066fbef72b5d9205f20ddc3f29b7c97e4e1b608f7bff3a03f9e411bfa382a4b95867cdb2db0ea758b838fade3c
SSDEEP 768:QIbjKAh1WmeLTFInrhPX5hJBg0iZ2QIqg0L8EagjDGeMHglcDM+o8h9ebBsKFhyp:QIfpreLB6FJSDZ2vY8MkacDMxbXhyioD
TLSH
T10AE2F12A08EDB1CB0E45C97DBFE5E8D48BE52020E2CDE91D57AD1072D6B3231DF64A06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 53KB
SHA256 f67450e41f4ffe9b3ae2856d1909d69948fb502e9286585446a50e4446d23a86
MD5 8e935b9235d13559d838d2b6a2b3a269
SHA1 4914108fc82a6798998a6f7e06592a92f24aac82
SHA512 752dbd967b99546db5840edf04886b351a70f428be1059a68fcc3d86af644889ef3192d8b987b7663d9ae001184e5427ee5d047c4790c36ff531e42a1bb61f72
SSDEEP 1536:HLtGdnfbGnppFEcm33HprLrxdS0L2skeB8:rgfbGnDFE7tPxXL2sl8
TLSH
T19A33023678D850192FFABA49BB3E91D07F9EF7CC9DD406A38C103DAD9098A64C644163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 158KB
SHA256 9aa55b9f9249b67a1eac36a629a1f4319fc63482d73645e3402f74705f641b65
MD5 10bec85e19c2105235ce05cd1a78929c
SHA1 431a3cf5d060d59be2230ad12b95ab4ae5110916
SHA512 31fa78f5ffa9180026164aecfe41cdfdf1e2a4a4f4e19b85080d01809473ad2643fa6f4a2e1b1be319731ac27e6dcd46c4d125b3325bbed58a38d08b2523fef2
SSDEEP 3072:7vv7XBl4dt1ZkuxUDuQsqcKmVNmWhlSmJsdbs12AL3wbbhs4ZE9v:jD6NkuKDuQVtuNzhAVdbs9kbb2aE9v
TLSH
T1ECF312497D87CEC4B993BFF0C2729A01AD48119A1C1981F76129E23C753A82CA9D5EF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 193KB
SHA256 3fb0963853e510320243f2fbaa2115017e4a838c10adf16984adc7ab901ae26f
MD5 15d504399a42d85f3176b9681360836d
SHA1 de242152896a6f233d31de648e638751918d47b9
SHA512 b765bb7f79e6ac6fae0ce24345186703784337063d038ae69ae0170244b30a76ce9ade1e37eba1fe26362370f49753a6229ffeba2c4711beae642d811eb0d298
SSDEEP 6144:ed7+izR2aOdx7chSRjcnoUb3N6xZPe/JO:e9+iz0a0VoSRY16jG4
TLSH
T1D11422D95228F54D1F54C05FAF627E40183CB6DAD085D3A0BD51D3BEB8CB452BB8A583
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000061

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
Size 207KB
SHA256 42af5fd4f363cd8eff2e8b22ec1ee68b421165ad0c504672ee792eca1baf53b4
MD5 76f1b823d373cd4ab1cc1bbd80e06d0d
SHA1 062d64fb6980ff2fdc4b94f9c214f4e35e241032
SHA512 40e5d41a8be703382c6e45654f6771275e4fe48b33849f558bec738dd1d6566f52190fbdbd4ebfde10042baec45084f1e9b12c7e06707e8a69863b4f0b202a9d
SSDEEP 6144:rorZFCnOFMp8S8HRDMHWgm0JQzs1U7UefiM+Vele2TRkMWNPF:cNFCnDp8WHF9JQ2IUeoVke7BtF
TLSH
T11F2413E1D3CF1F23D925421F1A6196C319EF19E021735893A93F0B8AA56393C89B3DE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 221KB
SHA256 a8be73d6e9da5f7643355d5e2c61a5eef08bb5ba3e38fd87a58692c4d8ce4a5b
MD5 8b71b55a1b70cceff8c81f1aec0053d9
SHA1 301c581ae0ab9d9f97d9f4cf3b4f86827697d810
SHA512 bfe5f7a82cf4ba51d1c93cee239dc75a98e75d1c5a6ea4dd6729b3a8cc63824b2bd33b69d9b0a11a7279ef87e46ceeb131cef234b2aac6eb5f9fc4132a2427b3
SSDEEP 6144:KCrKVsQl6FjVJsKPpaPIgfYaPgO9BAkPAV+L9F:rKVsQsFJbpqfHPgeBnuW
TLSH
T14E2423613B1381E276ED1A53FE0248048B67D3B8DCC9D34AA8E13105E5F679D197EE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
Size 219KB
SHA256 f9f663536094fddfed461d390e10bfe39f26512c7102d540d736b094f69e7669
MD5 b8bbb8370f28944cafa717336638b065
SHA1 635faeaa3a75a0cc28ce17e8dcfeeab39cb4eaf3
SHA512 6fed482dcebe684ffe5acba0ec3c8c63383aa8fc36c5e93634b2ecb5f21b6f32e1b73589e46f1ab3a75210fdbdba790bf25f9f348d43829adda92279f3e45ec4
SSDEEP 6144:uEJ5YGcRsfGKWLKgh11M8xVzMT2q6M2fptdbYgq:uUPcRsOZKO1OyVwTh6M2xDYv
TLSH
T1C32412861E90DA9CEABEC7104BB84537F43AB57CD398B08022DCDDD709647FA6446C97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 202KB
SHA256 f0a723172a663552380843999513419c4c7188c2584429fe54e77928b0206a27
MD5 4f9adec948aac4180082ad53389e4f0f
SHA1 3ee35cdcbf47b40803042c70ea10b4b2176a0282
SHA512 acaf03465160318a8ad980bf0d4af4852499640647cbc895db7b32d1ab4b1e9bc2f1474d966ab15cc455e6d05b0c6a514a5363d7065e70cae3e105098c9c15b3
SSDEEP 3072:3KJOdS7xpL+49EHKoag6ami1BwFKAMZzZ/Hxv4TThfRPSvP0yR+UmfbVyV0ID3Dg:3aP9S3agl1BmM3543hfRPS3AVk0Coz
TLSH
T12D1422C8E203C935B4D36B8AC43C97D20477BF4467165A658886CF272EB7291EDE1DE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 22KB
SHA256 081698792e32d16b7e808b86ae240fdf9566bf0a41cde29a2f69fda87781b808
MD5 13799e87f51281aca2d4ed8fcbe0500e
SHA1 0ec6bb9d1ad406fcb8b745831c9d7547d3e7de72
SHA512 3615e1f6e29cc2571e53ce8f49175060166392b524fb12d98b07a2d0153409286c698282aac4502d56943199295c3939a43f451d48c90bb08e1f07e457f3a149
SSDEEP 384:spyggodYRUnPtVvK9OaH4m9KotIysRRsnJ/iat+hUElhHhkHMAPO1:srgodYRUnPrvK9OaK0IysPsJ/ltslhBr
TLSH
T1DCA2E14F9941C77B1A6FA1BF506F5AE8A8FB5C0634130A43841DD05CA3B21576BC0BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 253KB
SHA256 e2c0a1646a7b39e24ffad61c6d6e3e38c2fd51a24d25192d330117449ae6170a
MD5 d645f82f247f421a4b3cc9562a1e433b
SHA1 aeefa9c822b7f582680ed24ea7ff2fcc317d2c61
SHA512 5db3cfed991ac07e712be3bb9cb82d23ec7afcbd5605118b00613f58c9a03406e727c09be9315da12c9dd82faae126b3daa24adc18c7377d6ad1f927f714f600
SSDEEP 6144:NgckMUEVoFi6BQ5j77TwHsB3hUNX8a9/2x4DuhGBQ4PVbiNG:acNgiaQJ77to2KsO/NGA
TLSH
T13A442390B6141AF14BB23574A03C16C6B7635C529FB61FAB2B81C8CDAFD91E11BC8B5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 264KB
SHA256 5a8405f2d38106672848e9f4fc34405744d4271e114186bb84d13ed62f094f6d
MD5 9af161f05fdc26dcdccd6910ffc26f5b
SHA1 65f9a5a652707b9d7a880bdb63e9ac95d8eaf13c
SHA512 911f7cc66ea09f5b7e11652f160e3ee46e5f78edaa5cc4ade6c1630755fd80df3f4b5c74d58d30585c0817cd12b90bb8be84168a2998bdaaa6bd59816abdea20
SSDEEP 6144:gONirTo8gY9bJy7TqhWUJUquBc6/oWCeEtkdB1O/8KCVHp/hBJni:8fomKaJSH/l6kvS89VHJI
TLSH
T12B44234741C1830670991ED74FB4F831C59BFF44B405AFBE6EAB830BA671899082ED5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 29KB
SHA256 9d9ea91873d1b2eeb660b44c235eb05ee182d6745b4a47181418f3e10de3c11e
MD5 ae450e9cb41c1c7e290f294f7c68cbd6
SHA1 c2b222bbb7fdf01e0c6451f630eeeb7219103146
SHA512 4df985de09a0cfb8bcaebc47116daa1557dd817a16926596f62122be900e488fa9f588779fecc07800576fa17a077027555d555efd65fbed7e623442ed7d0a99
SSDEEP 768:AhCY3RYSpQ79TBFxbg2K8sjkM6qwPICCpoox2BoBVDH:8CYqSc9TTFg2Q2fxCpxYoBVD
TLSH
T1B0D2E1CBC189639CB13E21CA07262FE99FC2CE3850D656B1A1CA705F076A567D970F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 25KB
SHA256 22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
MD5 d0263dc03be4c393a90bda733c57d6db
SHA1 8a032b6deab53a33234c735133b48518f8643b92
SHA512 9511bef269ae0797addf4cd6f2fec4ad0c4a4e06b3e5bf6138c7678a203022ac4818c7d446d154594504c947da3061030e82472d2708149c0709b1a070fdd0e3
SSDEEP 768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/
TLSH
T120C2E197C410D15DD123F2B5592B2F6C9A9220AC775E2A2606CE730B1CEEB3253A7357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 33KB
SHA256 6a2e194f895d8b7c3ac0c9438e793e5a6405fb116e65a3faaf6e7d142b09171d
MD5 dca6cdc3272f120096dcdce27c3929b0
SHA1 cc90b07d5a2cf456fa60c6c35733e787e1f2b5fc
SHA512 7aad364325aaf3c112acff2021e5bf531220f7d1a0077559d3ec29790276829bfd67ab99369a1a1879374e2b1a20e8bba53a117dd7589cdf3ccd89215f1d1a9c
SSDEEP 768:OWAtQ9l+Watug28P+xjX7HWJF4b5W52FcEjUCeF:T06o9WdrHuKok1wCG
TLSH
T19CF2F1F0E5FAEE5690870016EE595D3550A05FECB6268CD1F6FF1A4F87A274C20C7264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 dfec2ae31ec3f77dd3c13227ebdcbc7e2108e37495b022f298198857ffe51574
MD5 0ed5d1644292361beb1b229501a47398
SHA1 47aa83b8de5e7479cee76382c97ab0a5015242c4
SHA512 b1cff2353f6d1b387eb54d607d6a775eeb1843b8e25a3699e02476c5b54ed2f9d5048595b3947ca8b4888bf7bb40b3f41aa5f7a1ee9b9b6b7a61046d52703eca
TLSH
T1E8717284C58D62F1FFF84A7DEADDE847B6BC7C4045AB1FCD4998F2782E16395204A014
MD5 SHA1 SHA512 TLSH

Submit Download

afedf84e-3ea8-439c-b94d-19dc715f0cd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\afedf84e-3ea8-439c-b94d-19dc715f0cd8.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5586b3c8-848e-4343-99d6-dd0e263a2eea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5586b3c8-848e-4343-99d6-dd0e263a2eea.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dfbe6c6c-7680-4f5b-842c-0cd9a1d10586.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dfbe6c6c-7680-4f5b-842c-0cd9a1d10586.tmp
Size 2KB
SHA256 3f9c4bed64610f0d725cfbd309e68c31e5ac9d8f5b5c9f32c4648b0ba4af362b
MD5 2d2b4782b2df3d67c173bc850ae0bcc4
SHA1 3069c1cf86711b43dac66816ea34a093b0cc2105
SHA512 8fcaf9a26c0b5b1c170c27249b9c33e17b5236f538fe7e7a1c94eaafdf0f2a847ee4a95c304aa2681924212433be3b750745088348b86ee4469f0ab96a295acf
TLSH
T1094169F783B4996E8A0196F0AA149F2FCF2C0616431C7C2A89D4AE27D7F3472E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

a8216e9c-9d91-4443-9567-4c8420e14840.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a8216e9c-9d91-4443-9567-4c8420e14840.tmp
Size 8KB
SHA256 bf8a4e8e7fc5be976db1ebe67c0693232b76ec2d8c80a0987156856ee357fcef
MD5 902effbad35db83d17a15e97325b89c8
SHA1 c8cfb6a8a11cfc37bec8b2de2ac31f4c00f50e13
SHA512 69f3ea2e8eac1a69e3edcd941c9dcc2bfbc6ca3fd7c7db902d4add9b7a766184e9ebe9d2a93a186148ba1e181a52286abcd13b0241e76789a447d8697ffee1c1
SSDEEP 192:VGN+6QhLFQmiUyX3fzVZ/5P1yQh2JOEMLxU6:VGN+68LjsvzVZ/5tyQiUU6
TLSH
T1CE02D834B8687C7B8EE3AE55B58777239FE4107BDA952F40DAD82F2D01D768C1306922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5897d84-a8f5-44cd-846a-03ca8acc9985.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c5897d84-a8f5-44cd-846a-03ca8acc9985.tmp
Size 10KB
SHA256 890ee3c16e98bb6478f8abb1f5900c76c033707fb07594166ab06078fe7791a9
MD5 58fc3e4e6e68c04e7a36d4bfa844d0d8
SHA1 0f3145b77891cf2806703b1d7f95b4d1643d32cb
SHA512 136e6903af6980a2a08bac1e23523b928145fbfe8a1687d29121eabe53c903d60ddb4d7c5550151317b37984a36db46771f1e2d5cbeaa0a8147e1b1f070cbd0e
SSDEEP 192:zI8N6pQhLSo9QmiU1uAvU9ZIZ/5P1yQh2FtR6KJrqmv/U8:zI8N6p8LSWRvUjIZ/5tyQC/z/U8
TLSH
T1442218747868AC378CE7A156F18737A39EB4107BDD846F54D9D86F2C019B6882B4B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa2a2af4-c512-4d2d-bcc6-94f41b106345.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aa2a2af4-c512-4d2d-bcc6-94f41b106345.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 090ad6cad0afe0fa1536d124e95069f90d33f39887e85d2828e74f860e5381ed
MD5 a6a9f0410cb472c8701cb942f686e508
SHA1 0b98d12356c84a01ed42379fbd65543659946cf7
SHA512 db4eaf8eeba7b670317766794182dfcbe3cac79d69ccb7faeb4f531ac75ad064f52e01af31df4134cfdaae485d9f5c226e087eb3d71a01d5dc813c47f2688305
TLSH
T10F210A4685B818B6D7B1D36AF0F8BD61463FF1DD02D08A5CE019F6D39447462879F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads