Overview

overview

10

Static

static

10

2026-11-12...li.exe

windows10-2004-x64

10

2026-11-12...li.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    61s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 04:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-12_43af784ed56f59c52d918b16a0b5bbf7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
  • Size 1.5MB
  • Sample261113-ezenhszw7j
  • SHA256 e9916302e3c156be29d429e8062a54cc33f2af0246b6e3d763e1b43ba35f618c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoverysalityxredpersistencetrojanupx

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

  • sality

C2

  • http://89.119.67.154/testo5/

  • http://kukutrustnet777.info/home.gif

  • http://kukutrustnet888.info/home.gif

  • http://kukutrustnet987.info/home.gif

Signatures

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Modifies firewall policy service 3 TTPs 6 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Custom signature
    Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 38 IoCs
  • Custom signature
    UPX dump on OEP (original entry point) 44 IoCs
  • Executes dropped EXE 5 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
    defense_evasiontrojan
  • Windows security modification 2 TTPs 14 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 15 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 38 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\dwm.exe
    "dwm.exe"
    1⤵
      PID:1164
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
      1⤵
        PID:3148
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
        1⤵
          PID:3212
        • C:\Windows\System32\ShellHost.exe
          "C:\Windows\System32\ShellHost.exe"
          1⤵
            PID:3460
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
            1⤵
              PID:3260
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              1⤵
                PID:4340
              • C:\Windows\System32\RuntimeBroker.exe
                C:\Windows\System32\RuntimeBroker.exe -Embedding
                1⤵
                  PID:4380
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
                  1⤵
                    PID:4456
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:4752
                    • C:\Windows\system32\ctfmon.exe
                      /QuitInfo:0000000000000264;000000000000026C;
                      1⤵
                        PID:4964
                      • C:\Windows\system32\DllHost.exe
                        C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                        1⤵
                          PID:4996
                        • C:\Windows\System32\SecurityHealthSystray.exe
                          "C:\Windows\System32\SecurityHealthSystray.exe"
                          1⤵
                            PID:5204
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            1⤵
                              PID:3852
                              • C:\Windows\explorer.exe
                                explorer.exe /LOADSAVEDWINDOWS
                                2⤵
                                  PID:2076
                                  • C:\Users\Admin\AppData\Local\Temp\2026-11-12_43af784ed56f59c52d918b16a0b5bbf7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-11-12_43af784ed56f59c52d918b16a0b5bbf7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"
                                    3⤵
                                    • Adds Run key to start application
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4312
                                    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-11-12_43af784ed56f59c52d918b16a0b5bbf7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
                                      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-11-12_43af784ed56f59c52d918b16a0b5bbf7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"
                                      4⤵
                                      • Modifies firewall policy service
                                      • UAC bypass
                                      • Executes dropped EXE
                                      • Windows security bypass
                                      • Windows security modification
                                      • Checks whether UAC is enabled
                                      • Enumerates connected drives
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:5684
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ni.com/rteFinder?dest=lvrte&version=15.0&platform=Win7_32&lang=en
                                        5⤵
                                          PID:4244
                                      • C:\ProgramData\Synaptics\Synaptics.exe
                                        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                        4⤵
                                        • Modifies firewall policy service
                                        • UAC bypass
                                        • Executes dropped EXE
                                        • Windows security bypass
                                        • Windows security modification
                                        • Checks whether UAC is enabled
                                        • Enumerates connected drives
                                        • Drops file in Windows directory
                                        • Reads the TCP/IP host and domain name from the registry
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of WriteProcessMemory
                                        • System policy modification
                                        PID:1576
                                        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                          5⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:5064
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ni.com/rteFinder?dest=lvrte&version=15.0&platform=Win7_32&lang=en
                                            6⤵
                                              PID:3768
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:4528
                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                      1⤵
                                        PID:2784
                                      • C:\Windows\System32\smartscreen.exe
                                        C:\Windows\System32\smartscreen.exe -Embedding
                                        1⤵
                                          PID:5408
                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                          C:\ProgramData\Synaptics\Synaptics.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Drops file in Windows directory
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:5428
                                          • C:\Windows\._cache_Synaptics.exe
                                            "C:\Windows\._cache_Synaptics.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:2008
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ni.com/rteFinder?dest=lvrte&version=15.0&platform=Win7_32&lang=en
                                              3⤵
                                              • Drops file in Windows directory
                                              • Enumerates system info in registry
                                              • Modifies registry class
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of WriteProcessMemory
                                              PID:8
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x374,0x7ff83223c188,0x7ff83223c194,0x7ff83223c1a0
                                                4⤵
                                                  PID:4924
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,6951242075670585065,11155179352304348144,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:11
                                                  4⤵
                                                  • System Time Discovery
                                                  PID:5612
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,3841409110011749562,5731741090588607170,262144 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:2
                                                  4⤵
                                                    PID:6112
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,11684762041297296468,17388645714364704433,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
                                                    4⤵
                                                      PID:1868
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,13264638592764867531,9255173435198468966,2097152 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
                                                      4⤵
                                                        PID:4124
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,16739398416062393065,9591471039805784716,2097152 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:1
                                                        4⤵
                                                          PID:5180
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,678352951606868698,16854931806378587181,2097152 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
                                                          4⤵
                                                            PID:3752
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4132,i,7443293820175675996,8082766509137190295,2097152 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:9
                                                            4⤵
                                                              PID:2116
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,11040034351889752204,6919278835547042917,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
                                                              4⤵
                                                                PID:6088
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3516,i,8119263686861213078,9377476035140611457,2097152 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
                                                                4⤵
                                                                  PID:1752
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,10682384757735065812,9609104362082853691,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
                                                                  4⤵
                                                                    PID:3204
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,14422356567857529744,5575864610985628858,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                                                                    4⤵
                                                                      PID:5016
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6328,i,11286833978215338682,5577999622812475963,2097152 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
                                                                      4⤵
                                                                        PID:1856
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6532,i,1184149275239986784,3343143508037319274,2097152 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
                                                                        4⤵
                                                                          PID:1324
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6524,i,16868429639282686661,13414266986874228242,2097152 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
                                                                          4⤵
                                                                            PID:1172
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,17223814203496090393,14077507827880514416,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
                                                                            4⤵
                                                                              PID:4776
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,17223814203496090393,14077507827880514416,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
                                                                              4⤵
                                                                                PID:3376
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,16026986051609750197,5478984770111785938,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
                                                                                4⤵
                                                                                  PID:4952
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7000,i,9608100567202174515,2146066512478411694,2097152 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
                                                                                  4⤵
                                                                                    PID:1624
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7136,i,6561779425574701629,13552648054751684089,2097152 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
                                                                                    4⤵
                                                                                      PID:1160
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,9927380815228809163,6161268667651595887,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:14
                                                                                      4⤵
                                                                                        PID:4564
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,18417286754030617011,1877709999624316060,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
                                                                                        4⤵
                                                                                          PID:3156
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,9866374307632961341,14664035200005335524,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
                                                                                          4⤵
                                                                                            PID:1276
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,11341923935652521787,2111891919587299775,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:14
                                                                                            4⤵
                                                                                              PID:4156
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,11177688737143842842,11271594874261569036,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=7528 /prefetch:14
                                                                                              4⤵
                                                                                                PID:4224
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13193073071289574463,3649631767123794162,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:4880
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3044,i,11540265394980334169,17858908615271525811,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:3536
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,3943837984279471794,5918352075434964101,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=872 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:1352
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3212,i,3180712199317096661,12552907372256752545,262144 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:10
                                                                                                      4⤵
                                                                                                        PID:5544
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7600,i,14206421926287267327,8622822463827851073,524288 --field-trial-handle=2828,i,8136962207399023440,6085966053021807786,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                                                                                                        4⤵
                                                                                                          PID:1984
                                                                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                                                    1⤵
                                                                                                    • Checks processor information in registry
                                                                                                    • Enumerates system info in registry
                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:2236
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                    1⤵
                                                                                                      PID:5544
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                      1⤵
                                                                                                        PID:2504
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                        1⤵
                                                                                                          PID:4676
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                          1⤵
                                                                                                            PID:4388

                                                                                                          Network

                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                Reconnaissance

                                                                                                                Resource Development

                                                                                                                Initial Access

                                                                                                                Execution

                                                                                                                Persistence

                                                                                                                Boot or Logon Autostart Execution

                                                                                                                1
                                                                                                                T1547

                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                1
                                                                                                                T1547.001

                                                                                                                Create or Modify System Process

                                                                                                                1
                                                                                                                T1543

                                                                                                                Windows Service

                                                                                                                1
                                                                                                                T1543.003

                                                                                                                Privilege Escalation

                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                1
                                                                                                                T1548

                                                                                                                Bypass User Account Control

                                                                                                                1
                                                                                                                T1548.002

                                                                                                                Boot or Logon Autostart Execution

                                                                                                                1
                                                                                                                T1547

                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                1
                                                                                                                T1547.001

                                                                                                                Create or Modify System Process

                                                                                                                1
                                                                                                                T1543

                                                                                                                Windows Service

                                                                                                                1
                                                                                                                T1543.003

                                                                                                                Defense Evasion

                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                1
                                                                                                                T1548

                                                                                                                Bypass User Account Control

                                                                                                                1
                                                                                                                T1548.002

                                                                                                                Impair Defenses

                                                                                                                4
                                                                                                                T1562

                                                                                                                Disable or Modify System Firewall

                                                                                                                1
                                                                                                                T1562.004

                                                                                                                Disable or Modify Tools

                                                                                                                3
                                                                                                                T1562.001

                                                                                                                Modify Registry

                                                                                                                6
                                                                                                                T1112

                                                                                                                Credential Access

                                                                                                                Discovery

                                                                                                                Browser Information Discovery

                                                                                                                1
                                                                                                                T1217

                                                                                                                Peripheral Device Discovery

                                                                                                                1
                                                                                                                T1120

                                                                                                                Query Registry

                                                                                                                3
                                                                                                                T1012

                                                                                                                System Information Discovery

                                                                                                                5
                                                                                                                T1082

                                                                                                                System Location Discovery

                                                                                                                1
                                                                                                                T1614

                                                                                                                System Language Discovery

                                                                                                                1
                                                                                                                T1614.001

                                                                                                                System Network Configuration Discovery

                                                                                                                1
                                                                                                                T1016

                                                                                                                System Time Discovery

                                                                                                                1
                                                                                                                T1124

                                                                                                                Lateral Movement

                                                                                                                Collection

                                                                                                                Command and Control

                                                                                                                Exfiltration

                                                                                                                Impact

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                msedge.exe
                                                                                                                • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                • Size 3.9MB
                                                                                                                • SHA256 6d8e5d6a4d1c147b90b5a394a5054840e19dfa3eae3ea706ffb367477cecb929
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                Synaptics.exe
                                                                                                                • Path C:\ProgramData\Synaptics\Synaptics.exe
                                                                                                                • Size 1.5MB
                                                                                                                • SHA256 e9916302e3c156be29d429e8062a54cc33f2af0246b6e3d763e1b43ba35f618c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                6e2191a4-8e4c-4644-b7a5-454c70284910.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e2191a4-8e4c-4644-b7a5-454c70284910.tmp
                                                                                                                • Size 37KB
                                                                                                                • SHA256 14b1e58c9bd8dc7187becc5d6b8158e7d79f526d1b4df7b95f1cdd44f758ef87
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                85bb9000-55c9-4288-b1a2-aa5f389df1f8.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\85bb9000-55c9-4288-b1a2-aa5f389df1f8.tmp
                                                                                                                • Size 38KB
                                                                                                                • SHA256 59ee64388c503ffb80a8c483efbbc0f6a7fd8a2346d69d6aa08c01c0979e7c98
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a8e6db8-d3f3-4d14-88e0-2560fbe644b0.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9a8e6db8-d3f3-4d14-88e0-2560fbe644b0.tmp
                                                                                                                • Size 33KB
                                                                                                                • SHA256 ce5cc55d7b8bcbdb2ab2fe416f13d6ba9a7b11aeb26f07c499c2e1e61de9c48c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                manifest.json
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                                                                • Size 135B
                                                                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                settings.dat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                • Size 280B
                                                                                                                • SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                settings.dat
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                • Size 280B
                                                                                                                • SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                148bc462-6b67-4c62-8c90-23653cd17f8d.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\148bc462-6b67-4c62-8c90-23653cd17f8d.tmp
                                                                                                                • Size 11KB
                                                                                                                • SHA256 7aed61085f783e940cc17071b70408ce8dedfb7337db792f138d4a409d87141c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                5088f973-4fa7-4851-ad12-9e8b2748056a.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5088f973-4fa7-4851-ad12-9e8b2748056a.tmp
                                                                                                                • Size 13KB
                                                                                                                • SHA256 875ea24f782f30ea9602fcc7b3706d426866c268853c18e72f0612333b95c4a4
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                60f33b92-47c6-4ea6-97f1-9ddc6a507473.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\60f33b92-47c6-4ea6-97f1-9ddc6a507473.tmp
                                                                                                                • Size 70KB
                                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                9a1ede04-48e1-4845-852c-22e88ae52ec9.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a1ede04-48e1-4845-852c-22e88ae52ec9.tmp
                                                                                                                • Size 13KB
                                                                                                                • SHA256 b30565dd4328cdf7866b9951625e746f3d94cd3bf2fe084e71da80b7bbfc8cab
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00004a
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a
                                                                                                                • Size 34KB
                                                                                                                • SHA256 f739e4759e1bf88920406e589f971b4e06f666b624e2ee4c7efd3ee068d68162
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00004b
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
                                                                                                                • Size 34KB
                                                                                                                • SHA256 a11a79d87f68736326016cdbed3e0240b6acd83696cd69e4bb7f71e3d0ef2d14
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00004c
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c
                                                                                                                • Size 165KB
                                                                                                                • SHA256 12c07467d603fc097f21db25c52a1d1eac810dee2a770f0a1591ead22fcc162e
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00004d
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
                                                                                                                • Size 88KB
                                                                                                                • SHA256 d0855b0c557b78ea0449762b25ccca018880f483e56ff9a69e7cbde1dc12fa3a
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00004e
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
                                                                                                                • Size 35KB
                                                                                                                • SHA256 a4c0021145c59fbd6f01ac15cb4947c549cca783a041b45e7a2342a7f0be959e
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00004f
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
                                                                                                                • Size 41KB
                                                                                                                • SHA256 8ffbbcf102cc5dfb02912072f8932fa601468a89fcc7722f1909f3e576b1cc3c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000050
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
                                                                                                                • Size 30KB
                                                                                                                • SHA256 e3832cf459afb55dca2e524acd7a857d35b00395c21f98b896d3e0cd0db06ba3
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000051
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
                                                                                                                • Size 62KB
                                                                                                                • SHA256 06148d8e23bf039befd8857a62d258277d46638ac54df3b953f5573481dfceda
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000052
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
                                                                                                                • Size 45KB
                                                                                                                • SHA256 2a88940bbb259d8b9f09098aefb5b3bc706dfd06ca93c23ae230f02f0cb14a3f
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000053
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
                                                                                                                • Size 133KB
                                                                                                                • SHA256 08029bbd4af39443a39428a6942a2758fa6005847c70804f262e3e422963a794
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000054
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
                                                                                                                • Size 23KB
                                                                                                                • SHA256 c1dd3d7ddf698f2117c2a06b6a2a4341b2594be0f2b6fcfa429cd6b0c543ca87
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000055
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
                                                                                                                • Size 148KB
                                                                                                                • SHA256 c60cfce2dec71971c2b868f131522ae032f616d09d2eff0d79fb8a84abc293e4
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000057
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
                                                                                                                • Size 200KB
                                                                                                                • SHA256 5850ca03553d3cb26b6801beb329a5175999e787cf55f57fffa0912568880f4e
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000058
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
                                                                                                                • Size 168KB
                                                                                                                • SHA256 442ddc18140e4fd91e3fb0c53c3143b2ecc86c2c8d00bec08072092cde3ee900
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000059
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
                                                                                                                • Size 33KB
                                                                                                                • SHA256 9dc64bb4e816f8c1c5edc9b50ddcf5b9846ade6f7a6ac7ef8a4ecf9be1622663
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00005a
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a
                                                                                                                • Size 61KB
                                                                                                                • SHA256 752b32a7c227579d870a0f60c5a2fa8140b6f5bc62fb8be408cc9488a9f077c9
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00005b
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b
                                                                                                                • Size 32KB
                                                                                                                • SHA256 73a4e2dfd400d89208027bbfd45a00d87429ba5c76c8e28dffac1b649aa53e07
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00005c
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
                                                                                                                • Size 149KB
                                                                                                                • SHA256 8066070b83bb2c3abd9e3a0c5070697ca84ada06d3f5307a53d386db6d47178d
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00005d
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
                                                                                                                • Size 18KB
                                                                                                                • SHA256 9be58519ea2089be025b397b35f354a3f2e80c381fd508d80da83851084ed482
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00005e
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
                                                                                                                • Size 177KB
                                                                                                                • SHA256 ba9f06c5dd8a22f1a6d94df77eb1f52c13476cfcecdbb470c3f711e927eb50f6
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_00005f
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
                                                                                                                • Size 16KB
                                                                                                                • SHA256 3707908fdde7cd15703cf0579bf468b21a9b4e0f8c4ce562fc1e6159c0a237fb
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000060
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
                                                                                                                • Size 18KB
                                                                                                                • SHA256 97722715f92bfef1cccdf80f1dcee232f79e48a4b5612305ca2b864c352f0274
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000061
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061
                                                                                                                • Size 1.7MB
                                                                                                                • SHA256 1563e3c428f6323e6141b35b563e6f32f796ceba9dd7392657df49511d9e6fc9
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000062
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
                                                                                                                • Size 37KB
                                                                                                                • SHA256 97724206a9481a133e27e44db45c257cbbbff40e27bf2d4e25630711a98ef51e
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000064
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
                                                                                                                • Size 60KB
                                                                                                                • SHA256 3867a14caf4ca27119c08ec9ec2f8d9630ee94479a23593757b371b5d6636832
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000065
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
                                                                                                                • Size 37KB
                                                                                                                • SHA256 95d884efebc2a6f0ae1c57fce1bd5727647d369158f3b53cb2e0d05d58b82898
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                f_000066
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
                                                                                                                • Size 20KB
                                                                                                                • SHA256 ced325a448b0088250afcce1d724095c7cd712169b4c024791a660d1909e984f
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                temp-index
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                • Size 4KB
                                                                                                                • SHA256 e0a1296c13af25e5c934d561ff66f36aa16adfb4e5dc947d2a03e87ef00ed702
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                the-real-index
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                • Size 4KB
                                                                                                                • SHA256 b09cb61a795bde36718431fabf72557805fdd42df7bca103c4888201e0f3821b
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                the-real-index
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                • Size 2KB
                                                                                                                • SHA256 3f103ef5e1bfac27b37f5e4cb68a0acd0fce0b4ac11d27f75bf257f5dc655ef7
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                d4d708d6-afd7-45a9-8782-31fd08da0bb1.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d4d708d6-afd7-45a9-8782-31fd08da0bb1.tmp
                                                                                                                • Size 2B
                                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                • MD5 SHA1 SHA512
                                                                                                                Submit Download

                                                                                                                dasherSettingSchema.json
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                                                                • Size 854B
                                                                                                                • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                Network Persistent State
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                • Size 4KB
                                                                                                                • SHA256 3ad69a0daf32be90aeb543f536f219b9e40e7da3320f30f7b71aac22c7647943
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                c1821954-3c13-4d3b-9153-b311290435c0.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c1821954-3c13-4d3b-9153-b311290435c0.tmp
                                                                                                                • Size 40B
                                                                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                • MD5 SHA1 SHA512
                                                                                                                Submit Download

                                                                                                                dac15f84-13a5-41b9-93a5-4e6790c0979f.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dac15f84-13a5-41b9-93a5-4e6790c0979f.tmp
                                                                                                                • Size 2B
                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                • MD5 SHA1 SHA512
                                                                                                                Submit Download

                                                                                                                b3ff3372-20b7-409c-96da-471eb02eaced.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3ff3372-20b7-409c-96da-471eb02eaced.tmp
                                                                                                                • Size 27KB
                                                                                                                • SHA256 e8559fd604336a26616d1f28b61c9253ed93188ab257b7b72a46d52f972bd58f
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                c1916a24-7941-4f5a-a022-761d00ddd62f.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1916a24-7941-4f5a-a022-761d00ddd62f.tmp
                                                                                                                • Size 13KB
                                                                                                                • SHA256 3dbd4819529c0270c9f4df82c940c3bf2556802fbc95a14e2f571fe9698095e6
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                08da083f-3274-40e6-8ecb-b4d965b81b87.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\08da083f-3274-40e6-8ecb-b4d965b81b87.tmp
                                                                                                                • Size 22KB
                                                                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                OperationConfig
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                • Size 3KB
                                                                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                manifest.json
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
                                                                                                                • Size 43B
                                                                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                • MD5 SHA1 SHA512
                                                                                                                Submit Download

                                                                                                                aec89555-3c20-43a0-a72f-d784a0381d0b.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aec89555-3c20-43a0-a72f-d784a0381d0b.tmp
                                                                                                                • Size 38KB
                                                                                                                • SHA256 4ad9f9a27c68b44628c8f60e9653a086711e83a5208f1ed58ded425b8037f9cb
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                1ff762ab-60a8-4ff4-92a6-5309bb4f899d.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1ff762ab-60a8-4ff4-92a6-5309bb4f899d.tmp
                                                                                                                • Size 132B
                                                                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                d46e7825-7980-409d-b537-eb3236ecfffb.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d46e7825-7980-409d-b537-eb3236ecfffb.tmp
                                                                                                                • Size 37KB
                                                                                                                • SHA256 9aea25cc8e1aa673bff6eba1fb8adf44f9f0593ec1bffff32c90a7a4b2035e46
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                e1e5cb2c-1a06-4fba-854a-411b018d80a4.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e1e5cb2c-1a06-4fba-854a-411b018d80a4.tmp
                                                                                                                • Size 38KB
                                                                                                                • SHA256 4865cfb32e2d0506b2e2d583b175c7ee9f24e7ab1c097b5a5733a4791f474dbf
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                ea4d0623-198e-4aa2-bebe-bfa61cd0afdd.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ea4d0623-198e-4aa2-bebe-bfa61cd0afdd.tmp
                                                                                                                • Size 38KB
                                                                                                                • SHA256 b1fd980d16a7066eaee7faa67d00def88a16f1572a80002c6de292415bf4c38d
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                • Size 158KB
                                                                                                                • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                ad2d7713-bd8c-407e-b535-1498259c3878.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ad2d7713-bd8c-407e-b535-1498259c3878.tmp
                                                                                                                • Size 132B
                                                                                                                • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                d3916cde-9f26-417f-be1b-be80990e4300.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d3916cde-9f26-417f-be1b-be80990e4300.tmp
                                                                                                                • Size 13B
                                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                • MD5 SHA1 SHA512
                                                                                                                Submit Download

                                                                                                                ._cache_2026-11-12_43af784ed56f59c52d918b16a0b5bbf7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-11-12_43af784ed56f59c52d918b16a0b5bbf7_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
                                                                                                                • Size 823KB
                                                                                                                • SHA256 c6728c561d3da1d1525d9996b41dff71b7526333f15a1b1affabbde67696f75c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                40c98a1c-4d9f-4ca0-9cb2-7e50d5f267dd.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\40c98a1c-4d9f-4ca0-9cb2-7e50d5f267dd.tmp
                                                                                                                • Size 1B
                                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                • MD5 SHA1 SHA512
                                                                                                                Submit Download

                                                                                                                D4F95E00
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\D4F95E00
                                                                                                                • Size 22KB
                                                                                                                • SHA256 6da39fca9fe6c5001e83b9ccca908f49811fd6931a9fc1b53dde1c477d249169
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                FIOjYSxm.xlsm
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\FIOjYSxm.xlsm
                                                                                                                • Size 17KB
                                                                                                                • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                8f6b1959-02d6-4b17-b223-2b4d538067a7.tmp
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir8_2096763577\8f6b1959-02d6-4b17-b223-2b4d538067a7.tmp
                                                                                                                • Size 10KB
                                                                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                content.js
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir8_2096763577\CRX_INSTALL\content.js
                                                                                                                • Size 9KB
                                                                                                                • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                messages.json
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir8_928795815\CRX_INSTALL\_locales\en_CA\messages.json
                                                                                                                • Size 711B
                                                                                                                • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                winbwcty.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\winbwcty.exe
                                                                                                                • Size 65KB
                                                                                                                • SHA256 8e565d9becfaf350319e9053712ae39112827e2b84bf98713313b8e224776227
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                winxstts.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\winxstts.exe
                                                                                                                • Size 65KB
                                                                                                                • SHA256 30aed582538846e0facb27689235482b546b4bbf209a7cb4107ca174447826db
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                SYSTEM.INI
                                                                                                                • Path C:\Windows\SYSTEM.INI
                                                                                                                • Size 257B
                                                                                                                • SHA256 790f0199e078ecf12663f8f38a9f24158ccb3635c1efff31ac5021fbdffafdaa
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                protocols.json
                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_759503660\protocols.json
                                                                                                                • Size 3KB
                                                                                                                • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                Submit Download

                                                                                                                loaqkp.pif
                                                                                                                • Path C:\loaqkp.pif
                                                                                                                • Size 97KB
                                                                                                                • SHA256 9d854d1a9dfc7e1773370086f5938cfe3beb6d6b5bb41ce8fcfb546a0f5d6107
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                memory/1576-289-0x0000000003250000-0x0000000003252000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-1079-0x0000000007A70000-0x0000000008B2A000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-996-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-1109-0x0000000007A70000-0x0000000008B2A000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-413-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-1064-0x0000000007A70000-0x0000000008B2A000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-1074-0x0000000007A70000-0x0000000008B2A000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-1077-0x0000000007A70000-0x0000000008B2A000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-351-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-287-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-1078-0x0000000007A70000-0x0000000008B2A000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-684-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-1081-0x0000000007A70000-0x0000000008B2A000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-277-0x00000000033A0000-0x00000000033A1000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-150-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1576-1095-0x0000000007A70000-0x0000000008B2A000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2008-282-0x0000000002400000-0x0000000002401000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2008-281-0x0000000002240000-0x0000000002242000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2008-298-0x0000000002240000-0x0000000002242000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2008-273-0x0000000000400000-0x00000000004D3000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2008-301-0x0000000000400000-0x00000000004D3000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2236-293-0x00007FF815820000-0x00007FF815830000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2236-294-0x00007FF815820000-0x00007FF815830000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2236-302-0x00007FF813170000-0x00007FF813180000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2236-295-0x00007FF813170000-0x00007FF813180000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2236-290-0x00007FF815820000-0x00007FF815830000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2236-291-0x00007FF815820000-0x00007FF815830000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2236-292-0x00007FF815820000-0x00007FF815830000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4312-90-0x0000000003390000-0x0000000003392000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4312-153-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4312-0-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4312-92-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4312-149-0x0000000003390000-0x0000000003392000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4312-86-0x00000000034E0000-0x00000000034E1000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4312-85-0x0000000003390000-0x0000000003392000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4312-1-0x0000000002260000-0x0000000002261000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4312-2-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5064-279-0x00000000024A0000-0x00000000024A1000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5064-532-0x0000000002330000-0x0000000002332000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5064-269-0x0000000000400000-0x00000000004D3000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5064-283-0x0000000002330000-0x0000000002332000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5064-546-0x0000000000400000-0x00000000004D3000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5428-275-0x0000000000400000-0x0000000000591000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-284-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-725-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-930-0x0000000000400000-0x00000000004D3000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-912-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-918-0x0000000005BE0000-0x0000000005BE2000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-545-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-524-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-512-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-461-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-410-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-350-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-339-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-296-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-286-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-285-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-727-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-613-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-271-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-637-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-805-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-155-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-154-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-70-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-89-0x0000000005BE0000-0x0000000005BE2000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-73-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-75-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-77-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-72-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-74-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-76-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-79-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-91-0x0000000000400000-0x00000000004D3000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-80-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-78-0x0000000002520000-0x00000000035DA000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-88-0x0000000005C30000-0x0000000005C31000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-69-0x0000000000400000-0x00000000004D3000-memory.dmp
                                                                                                                Download

                                                                                                                memory/5684-60-0x0000000000400000-0x00000000004D3000-memory.dmp
                                                                                                                Download