Resubmissions

22/02/2024, 18:14

240222-wvl1gaea35 1

22/02/2024, 18:06

240222-wpzpdadh86 8

Analysis

  • max time kernel
    381s
  • max time network
    383s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 18:06

General

  • Target

    https://loot-link.com/s?o8TT

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Sets file execution options in registry 2 TTPs 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 2 IoCs
  • Registers COM server for autorun 1 TTPs 33 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 45 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://loot-link.com/s?o8TT
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd39246f8,0x7ffdd3924708,0x7ffdd3924718
      2⤵
        PID:2552
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        2⤵
          PID:5052
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4884
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
          2⤵
            PID:5028
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
            2⤵
              PID:1096
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
              2⤵
                PID:4852
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
                2⤵
                  PID:3204
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2572
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2556 /prefetch:1
                  2⤵
                    PID:4676
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                    2⤵
                      PID:2336
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
                      2⤵
                        PID:1544
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                        2⤵
                          PID:2004
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                          2⤵
                            PID:4268
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5080
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                            2⤵
                              PID:3444
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
                              2⤵
                                PID:868
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5348 /prefetch:8
                                2⤵
                                  PID:2072
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,2898825851292944323,12881940389836279672,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4412
                                • C:\Windows\System32\msiexec.exe
                                  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\EZFN_Launcher_1.0.6_x64_en-US.msi"
                                  2⤵
                                  • Enumerates connected drives
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  PID:2400
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4832
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:2104
                                  • C:\Windows\system32\msiexec.exe
                                    C:\Windows\system32\msiexec.exe /V
                                    1⤵
                                    • Enumerates connected drives
                                    • Drops file in Program Files directory
                                    • Drops file in Windows directory
                                    • Modifies data under HKEY_USERS
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1824
                                    • C:\Windows\syswow64\MsiExec.exe
                                      C:\Windows\syswow64\MsiExec.exe -Embedding 1D2386D6A39F6F231323BE8EFDBD5B8A C
                                      2⤵
                                      • Loads dropped DLL
                                      PID:4112
                                      • C:\Program Files\EZFN Launcher\EZFN Launcher.exe
                                        "C:\Program Files\EZFN Launcher\EZFN Launcher.exe"
                                        3⤵
                                          PID:4980
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.128\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.128\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.6 --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4980.2764.4936999768709436172
                                            4⤵
                                              PID:1836
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.128\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.128\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.184 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.128\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=121.0.2277.128 --initial-client-data=0x15c,0x160,0x164,0x138,0x194,0x7ffdc09bbf98,0x7ffdc09bbfa4,0x7ffdc09bbfb0
                                                5⤵
                                                  PID:1352
                                          • C:\Windows\system32\srtasks.exe
                                            C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                            2⤵
                                              PID:2560
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait
                                              2⤵
                                              • Blocklisted process makes network request
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1208
                                              • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                                                "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install
                                                3⤵
                                                • Executes dropped EXE
                                                PID:524
                                                • C:\Program Files (x86)\Microsoft\Temp\EUCAFD.tmp\MicrosoftEdgeUpdate.exe
                                                  "C:\Program Files (x86)\Microsoft\Temp\EUCAFD.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                                                  4⤵
                                                  • Sets file execution options in registry
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4968
                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    PID:2004
                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Modifies registry class
                                                    PID:4544
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                      6⤵
                                                      • Registers COM server for autorun
                                                      • Modifies registry class
                                                      PID:3580
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                      6⤵
                                                      • Registers COM server for autorun
                                                      • Modifies registry class
                                                      PID:2984
                                                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"
                                                      6⤵
                                                      • Registers COM server for autorun
                                                      • Modifies registry class
                                                      PID:4572
                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezI5RDFCRjhELTJDOTQtNDJFNy1CNkZFLTQ5NUEwRjkzOTRBNH0iIHVzZXJpZD0iezk2QjYyREM5LUQ2QTktNDdBMy1CRjRGLThBN0YxRDcwOTJBQX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7NzdDMTlEN0ItMTFBRi00Qjc2LTlFMEItRTAyRUUyQjQ1Mzk5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4My4yOSIgbmV4dHZlcnNpb249IjEuMy4xODEuNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzU2MjI5MTk1OCIgaW5zdGFsbF90aW1lX21zPSIxMzQ0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Checks system information in the registry
                                                    PID:4680
                                                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{29D1BF8D-2C94-42E7-B6FE-495A0F9394A4}" /silent
                                                    5⤵
                                                    • Executes dropped EXE
                                                    PID:1696
                                          • C:\Windows\system32\vssvc.exe
                                            C:\Windows\system32\vssvc.exe
                                            1⤵
                                            • Checks SCSI registry key(s)
                                            PID:4220
                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                            1⤵
                                            • Executes dropped EXE
                                            • Checks system information in the registry
                                            • Modifies data under HKEY_USERS
                                            PID:4004
                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezI5RDFCRjhELTJDOTQtNDJFNy1CNkZFLTQ5NUEwRjkzOTRBNH0iIHVzZXJpZD0iezk2QjYyREM5LUQ2QTktNDdBMy1CRjRGLThBN0YxRDcwOTJBQX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7QTM3RDc0REYtRDZFRC00RTAzLUEzRjQtRUIwRjQ3QjkxNzYwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIG5leHR2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc2MDEwNDE0NTUiLz48L2FwcD48L3JlcXVlc3Q-
                                              2⤵
                                              • Executes dropped EXE
                                              • Checks system information in the registry
                                              PID:1704
                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\MicrosoftEdge_X64_121.0.2277.128.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\MicrosoftEdge_X64_121.0.2277.128.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                              2⤵
                                              • Executes dropped EXE
                                              PID:4496
                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\EDGEMITMP_B9E42.tmp\setup.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\EDGEMITMP_B9E42.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\MicrosoftEdge_X64_121.0.2277.128.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                3⤵
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                PID:3948
                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\EDGEMITMP_B9E42.tmp\setup.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\EDGEMITMP_B9E42.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=121.0.6167.184 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\EDGEMITMP_B9E42.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=121.0.2277.128 --initial-client-data=0x22c,0x230,0x234,0x204,0x238,0x7ff6f91c1d88,0x7ff6f91c1d94,0x7ff6f91c1da0
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:2164
                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezI5RDFCRjhELTJDOTQtNDJFNy1CNkZFLTQ5NUEwRjkzOTRBNH0iIHVzZXJpZD0iezk2QjYyREM5LUQ2QTktNDdBMy1CRjRGLThBN0YxRDcwOTJBQX0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7NzE5N0Q5Q0YtNTc4MS00MDQ2LTlFRTEtQUM0OEJBMjlCRENBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTIxLjAuMjI3Ny4xMjgiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc2MTU3MjkyMDYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NjE1ODg1Njg3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzk1MTk3OTgxNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZDQ1YTUyZTktNTZkMS00Y2M2LTliZDAtMjhkMjQ2ODM5MDk1P1AxPTE3MDkyMzAyNjgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9V2x4SFBkbndTc0Y3dzlreW9sZDBGRzlhMHQ4d3ZLemxvWEVyTmd1a0xtMGRVZTFKcGhoYVNRNTZOMHRXWXAlMmIzY3FWM0ZPelluJTJmVGZvYlNtMmZTeVlRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc0OTYwNjk2IiB0b3RhbD0iMTc0OTYwNjk2IiBkb3dubG9hZF90aW1lX21zPSIyMDIzNSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc5NTIxMzU3MjQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3OTc1MTAzOTYxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NzM0OTk3NzA0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iOTA2IiBkb3dubG9hZF90aW1lX21zPSIzMzQwNyIgZG93bmxvYWRlZD0iMTc0OTYwNjk2IiB0b3RhbD0iMTc0OTYwNjk2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI3NTk5MCIvPjwvYXBwPjwvcmVxdWVzdD4
                                              2⤵
                                              • Executes dropped EXE
                                              • Checks system information in the registry
                                              • Modifies data under HKEY_USERS
                                              PID:4372

                                          Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Config.Msi\e5b9bef.rbs

                                                  Filesize

                                                  21KB

                                                  MD5

                                                  dfa4b896f803d4022c0daf6ef70ceabe

                                                  SHA1

                                                  ba896ba83c2a4e30917ed9a0ff6cad475a04a619

                                                  SHA256

                                                  78d054bff6ce91b95a28d272aa2da9dd1d62ec05ff47279d5772219f21554067

                                                  SHA512

                                                  a9fb020e75ab4696d08f4b2ad7b341e060969c4d8246634f840daacf2bc9686310f64e6d2cb772dbfe64c67860e46dc6ad83b189813912c605fae4ac7ff28a5b

                                                • C:\Program Files (x86)\Microsoft\EdgeCore\121.0.2277.128\Installer\setup.exe

                                                  Filesize

                                                  1.4MB

                                                  MD5

                                                  0e76af330b87534af9d6946a40c307f3

                                                  SHA1

                                                  7ddade37e0bbb03c9224520d8c29eda4be418448

                                                  SHA256

                                                  d7b76a198e245a4d1395eb9546856eeb72eac58d8fcbefece6144c53b6b84851

                                                  SHA512

                                                  ed8e5fe55eb54c111ec99d1b0d2ec1448452f6fbcfcacf1192ad0788c26e0e9e910086bcb7a0bfc013ea63d9e92f315c126f74c18f804ecfec95ac31816f2d37

                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\121.0.2277.128\MicrosoftEdge_X64_121.0.2277.128.exe

                                                  Filesize

                                                  9.5MB

                                                  MD5

                                                  61f9bb08b4fa0b7e1eeefeb4bdd1c44c

                                                  SHA1

                                                  fea6ee082cad7a4918def22fba8a9bc7618a6d94

                                                  SHA256

                                                  83dc335a8327c8ae42c46c7caeb6c765c575ad561d6a0d0a397913618038c14f

                                                  SHA512

                                                  d0e25b5e8341bcb295a9b65eaddbaa574130ab53dbc209f5360b131fe9d68a22e541bd7f17fe361b754ff7635449121c996498015a793e52417174f127f170ea

                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\EDGEMITMP_B9E42.tmp\setup.exe

                                                  Filesize

                                                  2.9MB

                                                  MD5

                                                  6f14e29d8fd3408fe7928c72724476ed

                                                  SHA1

                                                  cd5f207f40d81a2af2f833e76e65db810b8079b2

                                                  SHA256

                                                  b74d0d522a158879860b97757e28c02e3af372cb21487e03f46e51d9b4fe8df5

                                                  SHA512

                                                  89e80ba45c0c1562a62fd553086779ec46727db9774df5891e5f7cf54032bc4ccff41739961c13aba3ea0ef67a3b401a52ae3d180d35d2f8d27dc6a0aed68ae8

                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\EDGEMITMP_B9E42.tmp\setup.exe

                                                  Filesize

                                                  2.7MB

                                                  MD5

                                                  bfb25e519e347449cded735f89da245b

                                                  SHA1

                                                  54383ba6248b5a2e4cc951b40809c254e42f76cf

                                                  SHA256

                                                  165247e8585800e8488e5e7a66500c5a42c530cce5ced452cf981a4a20f480d3

                                                  SHA512

                                                  6f3b63d80b49d2641d380303ec40287e8dec89690d70087ca641a8bda4b0003b22f3f6724ddd8e0980af52c00a8bb658323a6721e556233b7a5efe5a2bf852fd

                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\EDGEMITMP_B9E42.tmp\setup.exe

                                                  Filesize

                                                  1.3MB

                                                  MD5

                                                  40096ca6db8e7976625ece134605f9ef

                                                  SHA1

                                                  41d79f8e4ec363639da98f065097d114fdaa5a96

                                                  SHA256

                                                  588ad1f284a538bab035c28d05e943478e84778d36119065625697216beca063

                                                  SHA512

                                                  2ae983cf247245ecb57e5912706712062c5455ee8871eed5e807872179fe5f696a09f496c88dfefdffa767822cd6d98abc28bd6fbf2087ff84d1c74bc83a47dd

                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\MicrosoftEdge_X64_121.0.2277.128.exe

                                                  Filesize

                                                  8.3MB

                                                  MD5

                                                  4ab5cd29973d8e71dbeb3c0f30ea3eab

                                                  SHA1

                                                  fe35735874ba7d0a90c726d40a3e927114e07b06

                                                  SHA256

                                                  1b0da309c37509eb6275eed0c55ca055bf2424c6c7fb0e5a6abe93ca2c5d9309

                                                  SHA512

                                                  058adbb6d1d51483fbe7402f7b9920574df117bc3d3bc8a917cfaaf12adfd2a5fa53ccdae1c0d38f6d6f950f3988596ad1f52606a30dea6d41f04bb6996f7d11

                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{3866ED66-0F88-4692-BA22-03A7953A9694}\MicrosoftEdge_X64_121.0.2277.128.exe

                                                  Filesize

                                                  3.1MB

                                                  MD5

                                                  5be0a5e150802a822f4e0e2acc1df85b

                                                  SHA1

                                                  34e84c352d456f8785f7cd215e1410b1a9d44ed3

                                                  SHA256

                                                  67d01580f7b937e094156cfa925d18366366bce52beef41f16bf81247b416ed9

                                                  SHA512

                                                  de1eb71465683857fdec2bad79e69184ef7f1f2ebdcab132b0223fd075e7915fbc31dbd6cf83c3f0c13869cdc36f1f29b57fc3dfa988da9a1f6f90fc48995b36

                                                • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

                                                  Filesize

                                                  201KB

                                                  MD5

                                                  11fe091ace9d03b9ada6d5a22d12c0d0

                                                  SHA1

                                                  5379ebe84500d425586904e7f9ac0393ab2a9d24

                                                  SHA256

                                                  50f4ed60a507ce9dd1f3f4e7d53053d923cb71594374a25251746a9b2271e4ee

                                                  SHA512

                                                  0f39af99697332c697ca62e2708e0a9200552a55f2d3057b64e9b18df2fe2828be750b14b5336ac9518b4c1282e82cd170b64587cf56b45b840ca231108b7fdf

                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.128\EBWebView\x64\EmbeddedBrowserWebView.dll

                                                  Filesize

                                                  2.5MB

                                                  MD5

                                                  3af54f9f39074e11bca49b3ba7d8aa6f

                                                  SHA1

                                                  979f30b6e94a71ad61bc3d69e33d3a65573e69bb

                                                  SHA256

                                                  9d96c36ad8dd69bd49e00a1fdda357d95ed289c55cdeaa73b41a2ba552c6ab00

                                                  SHA512

                                                  b6f627455a77f3bca5c4180d4a9ad07c281309834523def3f100402c817c9390fa0c2b15d14b09293009ac4b7d14281650742e0dba77e62f8ab74978eeb23eab

                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\121.0.2277.128\msedgewebview2.exe

                                                  Filesize

                                                  2.6MB

                                                  MD5

                                                  a9fa45a4b956424a0892bb3cb5cf5239

                                                  SHA1

                                                  38c27ae01bb9d858e2d1d5a1f57b224685675728

                                                  SHA256

                                                  2b43d505622683022172c5ecfc49217eb48295d9ea3f229993717dc2954fb049

                                                  SHA512

                                                  fddf5fe0ec1c38a4b6c445d63cf534aff53d0bfac4fe5d194e71b8f0a46aad97603a19c5c3cc1f9d6d4cb60f2de0e853536e4f9232eebc078197249f170529c7

                                                • C:\Program Files\EZFN Launcher\EZFN Launcher.exe

                                                  Filesize

                                                  6.8MB

                                                  MD5

                                                  70c012ed9b90522c3eff63590f86edf2

                                                  SHA1

                                                  e3f6c074d03fb7567b5857bd9a467e79a7f5141a

                                                  SHA256

                                                  b0e2efcb30ad5cfe7b25ed117d9f250d699e296c2f6a9d693cc49beef483527e

                                                  SHA512

                                                  bdf1ecc367e76dec556f0870d94578e8f4d6d598a5c290c8fd4af230f42ae13bb532d6dbfeac009dafef8fb500f6755cdf75168ca04d55445bfc6cf292ff0c7d

                                                • C:\Program Files\EZFN Launcher\EZFN Launcher.exe

                                                  Filesize

                                                  9.7MB

                                                  MD5

                                                  b0460088e6af329987045e46165c6d11

                                                  SHA1

                                                  89a45996ef1e6baf64f0e91be9e2c391869ba4ef

                                                  SHA256

                                                  18b15011798bac7a9be534c3b5832d80b137a8401ea093a326fccebc180f94d5

                                                  SHA512

                                                  91ab85ef78fcb958606ebbab6b3ed7ac82bc0165bb0bcda7e04d9f2b2ca349fb8da5c7b31cb3ec32fd5baff5359411d173cc8d2db306dd5203815501e4ecbadc

                                                • C:\Program Files\EZFN Launcher\EZFN Launcher.exe

                                                  Filesize

                                                  2.7MB

                                                  MD5

                                                  980a71ac12756883e466ad03db3d942d

                                                  SHA1

                                                  e308631a50ef52b162a3c9eb888cc446278be8cb

                                                  SHA256

                                                  89e0d327878b8174094850aeaadc35b78c2831a663b8203964f712bab950505f

                                                  SHA512

                                                  558ec0bdb515cf20685b077dd9b8f8b49d108998b23ed89f5169663df849e16f260f89568398fc007b38e758c3645c4b50783c1b22856dad29f71d51f67e8057

                                                • C:\Program Files\MsEdgeCrashpad\settings.dat

                                                  Filesize

                                                  280B

                                                  MD5

                                                  7b7312f110313f18fe8c2ad4210b23ef

                                                  SHA1

                                                  5ca06858669fc09ad414d42ad02fdcb046ff59d9

                                                  SHA256

                                                  11b25eb93d61f8df60c081578f27ca6c17f99a5ee479e35f002f9e2575e0d269

                                                  SHA512

                                                  91c6870860cb8756b7c4bf6fa276880b48d30ccd4a78b956f473caf406da618948e425d89a31c81de15ea2fe74c31066033a902e0f6edb646d9170d44a3f94b9

                                                • C:\Program Files\MsEdgeCrashpad\settings.dat

                                                  Filesize

                                                  280B

                                                  MD5

                                                  fd60284965f474ea2a1eaf0281cb4b8b

                                                  SHA1

                                                  89c99abaa6016c005eb2ec833b18c065834d3166

                                                  SHA256

                                                  0c5260f1cfec00c80524ea09470bdc7b443153f1c23f2c29070c79f8588afd24

                                                  SHA512

                                                  2b5bcba50c84ec064d471a3edf948190137755df7ed67432ada19621cff79b2b0c095b8727ae105601fa10ed17e6a996639f6e295df9402022805d6d786243b2

                                                • C:\Program Files\MsEdgeCrashpad\throttle_store.dat

                                                  Filesize

                                                  20B

                                                  MD5

                                                  9e4e94633b73f4a7680240a0ffd6cd2c

                                                  SHA1

                                                  e68e02453ce22736169a56fdb59043d33668368f

                                                  SHA256

                                                  41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                                                  SHA512

                                                  193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  118KB

                                                  MD5

                                                  5445169be59c08158cea58c46981c46a

                                                  SHA1

                                                  a9232dde2d8d42e533fd65f3b7cb2605b2806aeb

                                                  SHA256

                                                  75654df84051a3ccc838d63f3d832a2c0c182bc7ce7c05a66faa26cb0b88cddd

                                                  SHA512

                                                  93a488eff5502d315bfa73238e1a0190b6b3add47422ea2e1ff8f9264b593f17a489e0b099ab70c4111fdbbaae9f354d85cfc23576a9dff85798919d54dec028

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  120KB

                                                  MD5

                                                  c2375ff5c012952e3422c1c2287321c4

                                                  SHA1

                                                  4496c0007c220bf8261927300507ae7d4bfb1e70

                                                  SHA256

                                                  6ac8b070fb095d5609b63b12a5eb679303fd26de94f22f414ee2a837c56ecbef

                                                  SHA512

                                                  ec554d799648046f0218735977cde0d60dcf744d7b4e3e1b3390d1b7eeec6c124fb2f5cf65bb95456ede68eaf07e6b0b8d0c36f747571092c0449dc777630c09

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  122KB

                                                  MD5

                                                  3cc1fdb4d8e17abb1b65b57a878f24a3

                                                  SHA1

                                                  7b663649c2e2f7186c78ea9f9bb7c6b1d91ecd69

                                                  SHA256

                                                  c88f6c9862757fbcee5758fb297c5603faed13a72de6ab95edfe3ad8a74c92a9

                                                  SHA512

                                                  67f3c209ec9acc90885a82cc2ba29b3e194e883a9861b59dd31573975b87f658e3488854c229da39a41d27a686c796dcaae71487bbcf96bc58b5079ede010a07

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  123KB

                                                  MD5

                                                  c0d4e6eede3734d14085fb2fc8576616

                                                  SHA1

                                                  572cd0971ba0085a20a2efc3406896e75b54696a

                                                  SHA256

                                                  540f1d521313ecb3cd63aacf0103ffb9eaa440f9a90f9f0b9dccd73682fef114

                                                  SHA512

                                                  3e74c4b2b556c48a64667eb40625c5cebd2fc90192275d8a642692f21dd55909be376e8f8e23516a4738841947e4da5fe3fb8860ed867885b209c320afc83d23

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  126KB

                                                  MD5

                                                  510cf853e31f677ce1b4e0e04bb7a609

                                                  SHA1

                                                  7e09f92c242c9e476115452d623e7c45e0174511

                                                  SHA256

                                                  d609266a5031e86190e7ea87a703bf312bf7f0a83cb75eab114e812390355e00

                                                  SHA512

                                                  b2632299562157e3ba6f82a8f84c20be05f3dca3ab2fd7a9ea9f50f881b5e825766e9652c3da6f75046f653237a85459a5808d1ee221ac73fec2fa4aa67ca84f

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  127KB

                                                  MD5

                                                  7b189a1bff319f888dc72b5c3cc0172b

                                                  SHA1

                                                  723193a7cb4b5b05dabccb89666d1a9024147aa9

                                                  SHA256

                                                  3772e2b929d99a5a269060b9966c9b1d98df30c98d972b7f351568c0412d84cc

                                                  SHA512

                                                  8665418239dc6e8b3810f6040fb1e90bdda9e566a2722ed6957bf7cf4ef7b24448a2ffa08df4fce74faf84639c7e3382f02341de89c7424fed6830d9f70218c9

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  130KB

                                                  MD5

                                                  f99a2fb3db5e6a963e5bb256e61e7bb9

                                                  SHA1

                                                  4f39c8dea5d41f36dfd9874262e67890ecc1b3fe

                                                  SHA256

                                                  995f1d7a94a9b345ef6aa3847011cf15f0ba8efd7736e13faea531d20e767d69

                                                  SHA512

                                                  31befdc33b2ca9899ab4bdfbf61d4408e029675feb2535a175606e083fbcb6855543dd38064bd22b85817e2f4cd128eaa439b7207c191fd85b144734f992367d

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  130KB

                                                  MD5

                                                  20c475ef5a4d1693e6420d24fa7ec23a

                                                  SHA1

                                                  3964de0b2b569c08edb3311335aabe816a024d1e

                                                  SHA256

                                                  0a6d7436abf050a18d06cd80ae83753612f3f95a7b3bdb4219c9a2ac92b9348e

                                                  SHA512

                                                  be98a340d7a0f29d58ef8e09dbc23d8c3b5bb74fbb774c12faaf39a746011af3971bd5a40a8e7ff56185bfbf680fc70b1fe8532610e3fa40ce1c9e8286f9b840

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  135KB

                                                  MD5

                                                  60c8fdbb97147de1542ed5741c9d1b90

                                                  SHA1

                                                  1aa507e93a6461812a9f8cc393a2eefd7e18f6c2

                                                  SHA256

                                                  af6a441d02dcc49277c0dff699cd179884f16de4141cd99e9541ec094d9d469b

                                                  SHA512

                                                  4ce9b2357004b1c42fd37a4fc5a00397f3c4fa142495c3fef42c5c42aea5e995d1941848f71ada6a04433f9d631b9206b70ac9228f2f03d0d545fff1b2da7cf0

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  143KB

                                                  MD5

                                                  a1244b434bfa2a7db4eed4339d472204

                                                  SHA1

                                                  aab7c35dd99e158222da4aefaae9acab2c401931

                                                  SHA256

                                                  475bdeea13010901d0e5b26bcaebdc44014a9866798e94f6eed379254d6a7f57

                                                  SHA512

                                                  9c06fccbe9cc938ec198df913fe52e28617e7535d1953fdc5aee1154b3a2c12cd9313692b7fa66f4876be4bc95e149921e9a03ba4c0b002681d0423d80e5d55e

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  146KB

                                                  MD5

                                                  89e62b3ed7773d97420ce6b38c711db3

                                                  SHA1

                                                  f2615aee6f469f76ae06e2c6c169be546a03edad

                                                  SHA256

                                                  679d2c7bea674101e4d5cb4948c5da73e5dd9088bf37d2d9f0c6b4a843facb5f

                                                  SHA512

                                                  da85441072c7e6e18c3fdb1401205422fdddd51627db5bcaa471c0b8fb7c267350771a343421f526a980292d989f6482e4ee1e4db1fe3903b331edc3e10f9b10

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  147KB

                                                  MD5

                                                  af3e61722c0980c346fa27fa3effa324

                                                  SHA1

                                                  b0eeaeb8669c0928fb125dec5a5e54f9e6a6b7e6

                                                  SHA256

                                                  60acd97a4197a0e7b405cc710ae747d2368ec01fc0e40fa6b92d5e26fd3767e4

                                                  SHA512

                                                  2d421675b52905a1eaaf56607efedeec68f930f2a60344df18c96cc266d44cb0715eebbceb2108b437e94d49dd7a023a7590df06bc4fe6805cbac56767b8676c

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  152KB

                                                  MD5

                                                  87f6eb7b5bfbdbc2575ccf1ce6bd1cd0

                                                  SHA1

                                                  78af934a6db9b284ed38b4912fb71445e9c872c7

                                                  SHA256

                                                  14fe2ece385617bf9994f98b3bde88ef1244848a9d99fc0b2900f75e7d761119

                                                  SHA512

                                                  f7e259b222361672a8e001727bde9d401988ac18985523a89ce0bc20c39457c8c31374f133135bce44cfa3f266d24da0656c7e721e86d420b8d06efdd59522fb

                                                • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

                                                  Filesize

                                                  220KB

                                                  MD5

                                                  46e5a60911156fed96a4e33fd5ecdb29

                                                  SHA1

                                                  46d199648c6e2d587ccefd29ba0117175dcaf65c

                                                  SHA256

                                                  330eed1898957b0aafdd0b6a0ef212d9f76bf19e70637b7f59a63a4e9c422e6b

                                                  SHA512

                                                  f5c205f51e89c3022bdaab8da3a15330c76c75bde773d69a7d2ec18d49eb335a1fac9d857f5f5d5f71320e20361cc361d94f036e05fbbe6923eb230024c78864

                                                • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  6bb00ebbfe3834c6c82085399d1fb208

                                                  SHA1

                                                  6545747dd98c4b15e83691487d7a19d93a71e982

                                                  SHA256

                                                  d5859eee0d9da742216522ed5d7fac9207fb02ec04adb358b6e935ceec2a8754

                                                  SHA512

                                                  47bd94d51fe75b448c9facc87f997176746733fc0cd1789d96da8e78a9f91845ca7e407353155c2bb6ae35a6c1eaf65e0e0ae18fa326e2a3db2879b6f70d3a32

                                                • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk~RFe5ba2d4.TMP

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  4224a3a7dd184c8004f05be09907c080

                                                  SHA1

                                                  7c8a6cd7dbd523efd3d9d48a2f6be8af96eb0fcf

                                                  SHA256

                                                  51ef096d920f94ddcaba1a78adde67d435f4a5b0b9c234e497b64e9e34f48941

                                                  SHA512

                                                  dbfebbaccc226f44d2326c5e6449d21d5207e39bec4c6ce49e9b5b160600d47a1d4f5a6dbce77cbad14fe1512cd0554aa625330db882043a9aaa840bc6edc684

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2aee31af-e5e9-4c81-966a-2cb0201e3dc0.tmp

                                                  Filesize

                                                  11KB

                                                  MD5

                                                  f1521b18d04ddc4472b71539e7025c6d

                                                  SHA1

                                                  c84387e7e2da24ef32af5a7506bf6d6035986dba

                                                  SHA256

                                                  ace188ced8ca8e6c585f0122822f70962e93cf619dda6a195b025b4975aa335a

                                                  SHA512

                                                  8dfa034d2863764f6d866bcf10cc78b710a573b2444086fe448f9a1ce9193ef55aa5ccf7eae1727159ea92ba75139e9310c536985478411668c4f5c7555c4e0e

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  360dd5debf8bf7b89c4d88d29e38446c

                                                  SHA1

                                                  65afff8c78aeb12c577a523cb77cd58d401b0f82

                                                  SHA256

                                                  3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

                                                  SHA512

                                                  0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  6fbbaffc5a50295d007ab405b0885ab5

                                                  SHA1

                                                  518e87df81db1dded184c3e4e3f129cca15baba1

                                                  SHA256

                                                  b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

                                                  SHA512

                                                  011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  144B

                                                  MD5

                                                  b7e41277a07df3de4b55ef7f67a19e9e

                                                  SHA1

                                                  9f1a5c02d2b0d69d4fbbbd8604f9125ffe5add15

                                                  SHA256

                                                  01c4de29f5960a3d693b772b54f9cc8a3c3a8920f4101f8f8d268e43f31c7ad8

                                                  SHA512

                                                  e60959fa3538d0a1582f65c9ee0a224a637d1ba58f36622ade01472b1c609ee95e1b6d81a119afb51ce54fe97794fe67d03a4cf037cc01c49b5d8a63779bf4ae

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  fea730f88da08b8fa03297916ad5e9dd

                                                  SHA1

                                                  1b79848215a5b7af724f5ad6e67a01806bcbca0c

                                                  SHA256

                                                  f448f35884b3bd9e70273d9d3fa2725285c6250c660c15f0dd500799e6b8b740

                                                  SHA512

                                                  4292f6565f3a2a51b7443291e8bf91eb9449c37c43065dd4c3eb6ae381614639bcc61ef71d99a8e1c8a51c113b15ac32216bf8dba612dc54478ddfa0427c55f6

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  5b1f6a44908691631654a6631d5a4f3c

                                                  SHA1

                                                  e901535558c67acf834533809b1a9551a64dda83

                                                  SHA256

                                                  fd9c8b6df6d068b2ee36842f8f0ac63f4283c687d752d981d261b525d7015a6e

                                                  SHA512

                                                  f2dc4dadad44440720a6ebd08710d121cbd70c80fc629caf43b0bebfb8708813a6589b1d9812ca2a55febb77e1165ea0f39809defd7ef19b259503fe17f05382

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                  Filesize

                                                  1KB

                                                  MD5

                                                  33ff7516b7a8497f43b41824d14e85cc

                                                  SHA1

                                                  1a10065a9dc9fe16dfb5dce89478e35ef7e0b7a1

                                                  SHA256

                                                  c13880fef2aaea0b1f4e788c692e78e8fdd66319656d34c3e80480f3355c5f85

                                                  SHA512

                                                  a73ce6c1695970ca919bddccacc66482f43c9d433c975c0d2c74467bd0e1413dd7615fc8afffd9f893ebe6a73ed2de11011c306deb91767d082150a90b0964c1

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  a9eecedaf6a2377957d7858aa208f860

                                                  SHA1

                                                  04f95a8ad2e1a737b39c1ec8de30877163403b5e

                                                  SHA256

                                                  6a89462a97c1354df0b4739905c84912eef10581e662730d1db1981353edf5ae

                                                  SHA512

                                                  6411f2d4d543b2f404bd130bf2ef8c6a05bc302e09aeea6e86a400f1c874382ac5356fbc0fa5c663c1f009c84555d61567a72376d064ad63e0bbf5ebf1b8bbbe

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  0f8b4d838036e8a8552d353c9ce926b3

                                                  SHA1

                                                  f36a5569e7d8dd55917fdb84e77fb964f4a1e0b2

                                                  SHA256

                                                  1fca0c2d5b38777d6b2058a9727b63c498eb49313642542194018109476ba0f2

                                                  SHA512

                                                  fe108e5a4f00fdfc688823b04dd7658a8cf34519015114841d3733a47cd8923d1a92d4d54c075ad4d6be9a9e9c57eca7724a62fec0375ee6bc1435e98ff5ed57

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  a50a014ead91dd5017dea515053637ee

                                                  SHA1

                                                  896542b184be9da104230b6faf5341c8dac1a367

                                                  SHA256

                                                  3dfd780740f061aa4cf9f03b400d1f8911dec24ebec6d1b049f22689f01cc9e9

                                                  SHA512

                                                  860fe02bc270b9b044218735f8f3a5c167422e44148b2443006d56e55d52f980130f93276982e3194d944de6bcd2e06a75cc93139149a4d80daeb11d0422af12

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  89d168dfc7ef0205ee7ddff18e0cfe33

                                                  SHA1

                                                  b2fe67595b03aff275ebebeba1e86e441f3bcba8

                                                  SHA256

                                                  115ed6f64eed0f82cf5eb637a8a972ae2caee9023573ebe675831123fd2dd15e

                                                  SHA512

                                                  77ce8c2744a98d7b5cfc84561636bc9b4d342768cf9a22efded494c6f3e00a1e69c625be32c3cb5f93e129f56078bffe2896c2f9c1b6f03aa574c7b12bf62de4

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  a6047b5200435dfcb30b952f0b619fd1

                                                  SHA1

                                                  962c49fe61e51819ee1d7497cc59d2256576caa5

                                                  SHA256

                                                  df6f1e5651a5f1036a296bf7b80c31eb6675539d52c9905cfce1d8914392cbeb

                                                  SHA512

                                                  8f3cc40f30a5fd041d16d26ab0f3082b9156edd15adf01e90e4174073e4bfbccc00d42a4f86d99ef17ff84440c264720718496f59c7fb167f8c4410d325484de

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  42f5ed78da631559149facc04f42dbf7

                                                  SHA1

                                                  81c30001ab73e8d71ce1a07fb90cc89caf38017a

                                                  SHA256

                                                  996c74551eaf2783bdda6666271c8156574f7757ccc6e1b7c89802acdc931178

                                                  SHA512

                                                  479e999c2a015bda29905e81181ea8f3e8c81aaa25490564250fad8919d8500a9c335b373e564770aabb3b1269c9364792db3ad2e46bd7fea8309717a8fc6dcc

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                  Filesize

                                                  16B

                                                  MD5

                                                  6752a1d65b201c13b62ea44016eb221f

                                                  SHA1

                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                  SHA256

                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                  SHA512

                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                  Filesize

                                                  12KB

                                                  MD5

                                                  ca5085da699db2b9fcf8535663e219ef

                                                  SHA1

                                                  7c59dc0348aa0cf872aca04707d261b0afe26163

                                                  SHA256

                                                  c89d9054ec7670c019c4ddaf502f622ea7942b370c108baf7f4dde7526cc1a8a

                                                  SHA512

                                                  560fe244eb7da3583e9df2313d7f489f1f3e4c37348493c2fe4cb06fa9d156a47414d9eb990f1c0690744807e4d64ad2fbd4b2d86bda626af55c6d58b8c23855

                                                • C:\Users\Admin\AppData\Local\Temp\MSIB663.tmp

                                                  Filesize

                                                  211KB

                                                  MD5

                                                  a3ae5d86ecf38db9427359ea37a5f646

                                                  SHA1

                                                  eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                  SHA256

                                                  c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                  SHA512

                                                  96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                • C:\Users\Admin\AppData\Local\Temp\MSIDCF4.tmp

                                                  Filesize

                                                  113KB

                                                  MD5

                                                  4fdd16752561cf585fed1506914d73e0

                                                  SHA1

                                                  f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424

                                                  SHA256

                                                  aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7

                                                  SHA512

                                                  3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600

                                                • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe

                                                  Filesize

                                                  1.5MB

                                                  MD5

                                                  2fbe10e4233824fbea08ddf085d7df96

                                                  SHA1

                                                  17068c55b3c15e1213436ba232bbd79d90985b31

                                                  SHA256

                                                  5b01d964ced28c1ff850b4de05a71f386addd815a30c4a9ee210ef90619df58e

                                                  SHA512

                                                  4c4d256d67b6aadea45b1677ab2f0b66bef385fa09127c4681389bdde214b35351b38121d651bf47734147afd4af063e2eb2e6ebf15436ad42f1533c42278fa4

                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cm3i2jil.gd3.ps1

                                                  Filesize

                                                  60B

                                                  MD5

                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                  SHA1

                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                  SHA256

                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                  SHA512

                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                • C:\Users\Admin\Downloads\EZFN_Launcher_1.0.6_x64_en-US.msi

                                                  Filesize

                                                  1.5MB

                                                  MD5

                                                  0e54198007059141485bd602a0c34b1b

                                                  SHA1

                                                  267fbd58a24774e620772be2a319385bee64a74c

                                                  SHA256

                                                  0a4775e49e4d77662e3a735d114a853aa5631dfdaf0a22675acde6c5cc7cfa87

                                                  SHA512

                                                  05cfef701756272ba8fc4906afdd3f4bd539e166d034e9047b2ec3b5325179b52cb7780140961bc6c87e529e017d19eed2ce201bed8c8cde6f0cbabbd530c554

                                                • C:\Users\Admin\Downloads\Unconfirmed 985694.crdownload

                                                  Filesize

                                                  6.2MB

                                                  MD5

                                                  9bc3af7785e3b5982a6028ebbe156cb6

                                                  SHA1

                                                  e2828a9e9ce582924df04443b303da3445250f0a

                                                  SHA256

                                                  679fefee2262a7bda75c2a40494f378ad4583780ae98b767cd4f550f36e34f74

                                                  SHA512

                                                  7284eec7714bd92eecd0c4cb55bed00c37ea8c21b42f56246153838dc3cdc2e60c3f3a3cfc3aad7dd6a2a66b56b12ea298767826a01730befc582ff44c73d78c

                                                • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                                                  Filesize

                                                  15.8MB

                                                  MD5

                                                  d90c5982647f807f9f88341f52508d9d

                                                  SHA1

                                                  e708c20839d5511d19beb3eba401e1cd97c0632d

                                                  SHA256

                                                  9f599e06abb4df9b68383316ccf7a0cb8251728d26bd97524764fa59a51a7e01

                                                  SHA512

                                                  22f6196520d88c89bb74f48287f82286542debf6f2bd7a16d7bdc66d491abb7ee0440cc1a920a090c571fe1ab57a6d4f40ec4e9c50963af35eeb09139b64d003

                                                • \??\Volume{d3f0c1b4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e142eaed-d484-4c1c-aa0b-69fe24908e90}_OnDiskSnapshotProp

                                                  Filesize

                                                  6KB

                                                  MD5

                                                  1095da600071baf7875913277b77f94d

                                                  SHA1

                                                  aad01af361baabc024a91cd6d7cb61577e2b080c

                                                  SHA256

                                                  c6c8855c5f9f7bb33792addc2a93f51885e4d48f458f066744b58e51ccdecfe8

                                                  SHA512

                                                  5344c45d419b9840c6e4ffeedf633b554d21f0a04cbf0ac519536bb7663864382da2f4dd0abab232b3661b4502d506ab3e52df98f3d2f300ba481d333139822f

                                                • memory/1208-386-0x00000115F6370000-0x00000115F6380000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/1208-311-0x00000115F6400000-0x00000115F6422000-memory.dmp

                                                  Filesize

                                                  136KB

                                                • memory/1208-441-0x00007FFDC1230000-0x00007FFDC1CF1000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/1208-321-0x00007FFDC1230000-0x00007FFDC1CF1000-memory.dmp

                                                  Filesize

                                                  10.8MB

                                                • memory/1208-322-0x00000115F6370000-0x00000115F6380000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/1208-323-0x00000115F6370000-0x00000115F6380000-memory.dmp

                                                  Filesize

                                                  64KB

                                                • memory/1208-385-0x00007FFDC1230000-0x00007FFDC1CF1000-memory.dmp

                                                  Filesize

                                                  10.8MB