Overview

overview

10

Static

static

3

EzFN-Manager.exe

windows7-x64

10

EzFN-Manager.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2024, 02:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    EzFN-Manager.exe
  • Size 11.3MB
  • Sample241128-c7k46a1rax
  • SHA256 2abb6eefa29e46e8580cfb9f4eff67913423197ed103b694e4158e0e6ed2ba79
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
skuldxwormdiscoveryevasionexecutionpersistenceprivilege_escalationratstealertrojanupx

Malware Config

Extracted

Family

  • skuld

C2

  • https://discord.com/api/webhooks/1309150098055495793/k9e9xgOw-6_C2plzzrJuXKnk0n6rjOfFwyNN15kYdvJC528Av5hMa6QHDC_kqeEBzjsS

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • ezfn57.serveo.net:4782

Mutex

  • UoXEvvukylvflHuQ

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    WinRar.exe

aes.plain

Signatures

  • Detect Xworm Payload 1 IoCs
  • Skuld family
    skuld
  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 36 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Checks system information in the registry 2 TTPs 12 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 44 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\EzFN-Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\EzFN-Manager.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Users\Admin\AppData\Roaming\WinRAR.exe
      "C:\Users\Admin\AppData\Roaming\WinRAR.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4840
      • C:\Users\Admin\AppData\Roaming\WinRAR.exe
        "C:\Users\Admin\AppData\Roaming\WinRAR.exe"
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4412
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WinRAR.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4136
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WinRAR.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4924
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WinRar.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2444
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WinRar.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1712
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WinRar" /tr "C:\ProgramData\WinRar.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4336
    • C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\Windows\system32\attrib.exe
        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe"
        3⤵
        • Views/modifies file attributes
        PID:4592
    • C:\Windows\System32\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\EZFN Launcher_1.2.7_x64_en-US (1).msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3792
      • C:\Program Files\EZFN Launcher\EZFN Launcher.exe
        "C:\Program Files\EZFN Launcher\EZFN Launcher.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:4824
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.7 --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --no-proxy-server --lang=en-US --mojo-named-platform-channel-pipe=4824.216.7770728087879826576
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • System policy modification
          PID:1868
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.86 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=131.0.2903.70 --initial-client-data=0x160,0x164,0x168,0x13c,0x198,0x7ffb45976070,0x7ffb4597607c,0x7ffb45976088
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1456
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1836,i,4843055546335352655,3962978543885882024,262144 --variations-seed-version --mojo-platform-channel-handle=1832 /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1900
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1992,i,4843055546335352655,3962978543885882024,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:3
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4512
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2316,i,4843055546335352655,3962978543885882024,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4328
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.70\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3164,i,4843055546335352655,3962978543885882024,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2880
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
          4⤵
            PID:2388
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb56c946f8,0x7ffb56c94708,0x7ffb56c94718
              5⤵
                PID:4596
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4456344066900781869,13670419514763162785,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
                5⤵
                  PID:4720
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4456344066900781869,13670419514763162785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
                  5⤵
                    PID:1732
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4456344066900781869,13670419514763162785,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
                    5⤵
                      PID:644
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4456344066900781869,13670419514763162785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
                      5⤵
                        PID:4616
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4456344066900781869,13670419514763162785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
                        5⤵
                          PID:3268
                • C:\Windows\system32\msiexec.exe
                  C:\Windows\system32\msiexec.exe /V
                  1⤵
                  • Enumerates connected drives
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1320
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding 7C0A3E86903B10C7D82CE381AE4CF129 C
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:5008
                  • C:\Windows\system32\srtasks.exe
                    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                    2⤵
                      PID:4392
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ( '/install') -Wait
                      2⤵
                      • Blocklisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:232
                      • C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                        "C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /install
                        3⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4632
                        • C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\MicrosoftEdgeUpdate.exe
                          "C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\MicrosoftEdgeUpdate.exe" /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
                          4⤵
                          • Event Triggered Execution: Image File Execution Options Injection
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks system information in the registry
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:784
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            PID:4864
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:3336
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies registry class
                              PID:3928
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies registry class
                              PID:1028
                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe
                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
                              6⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies registry class
                              PID:3228
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEI3REQ5RTUtMUI3Ri00NUU1LTlDRDktOUVERTU0MDZENTYyfSIgdXNlcmlkPSJ7NDEzODQ3MDItNUMyRi00RDdFLUE2REQtMDU1RjZGMDRGMERBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswOUZGMkQ0NC0wM0VDLTQwMkMtQjA0Qi05M0Y1ODJBQjJEMUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjU2MTU2NDg3IiBpbnN0YWxsX3RpbWVfbXM9IjU5NCIvPjwvYXBwPjwvcmVxdWVzdD4
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks system information in the registry
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            PID:432
                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{8B7DD9E5-1B7F-45E5-9CD9-9EDE5406D562}"
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:1388
                  • C:\Windows\system32\vssvc.exe
                    C:\Windows\system32\vssvc.exe
                    1⤵
                    • Checks SCSI registry key(s)
                    PID:632
                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Checks system information in the registry
                    • System Location Discovery: System Language Discovery
                    • Modifies data under HKEY_USERS
                    • Suspicious use of WriteProcessMemory
                    PID:3256
                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEI3REQ5RTUtMUI3Ri00NUU1LTlDRDktOUVERTU0MDZENTYyfSIgdXNlcmlkPSJ7NDEzODQ3MDItNUMyRi00RDdFLUE2REQtMDU1RjZGMDRGMERBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDU0QTRCMDctMTU3Qi00MzY3LTg5MEQtMDZDNDU5ODNBMEREfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2NCWUVZWDg3MXRzR3VLSmFvNjNYalV0NXZKRTlYeENUbkU3SDBQZ1VqS0U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1MSIgaW5zdGFsbGRhdGV0aW1lPSIxNzI4MjkyODgxIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNzI3NjU0NjE3MDEwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTI1OTI4MTUxNiIvPjwvYXBwPjwvcmVxdWVzdD4
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks system information in the registry
                      • System Location Discovery: System Language Discovery
                      • System Network Configuration Discovery: Internet Connection Discovery
                      PID:3592
                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{71306415-1E62-4809-A46B-A84D799DE78F}\MicrosoftEdge_X64_131.0.2903.70.exe
                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{71306415-1E62-4809-A46B-A84D799DE78F}\MicrosoftEdge_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                      2⤵
                      • Executes dropped EXE
                      PID:404
                      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{71306415-1E62-4809-A46B-A84D799DE78F}\EDGEMITMP_32973.tmp\setup.exe
                        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{71306415-1E62-4809-A46B-A84D799DE78F}\EDGEMITMP_32973.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{71306415-1E62-4809-A46B-A84D799DE78F}\MicrosoftEdge_X64_131.0.2903.70.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                        3⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        PID:3888
                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{71306415-1E62-4809-A46B-A84D799DE78F}\EDGEMITMP_32973.tmp\setup.exe
                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{71306415-1E62-4809-A46B-A84D799DE78F}\EDGEMITMP_32973.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.86 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{71306415-1E62-4809-A46B-A84D799DE78F}\EDGEMITMP_32973.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.70 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff714512918,0x7ff714512924,0x7ff714512930
                          4⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          PID:4132
                    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEI3REQ5RTUtMUI3Ri00NUU1LTlDRDktOUVERTU0MDZENTYyfSIgdXNlcmlkPSJ7NDEzODQ3MDItNUMyRi00RDdFLUE2REQtMDU1RjZGMDRGMERBfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5OUVDRkNDRS03NzAzLTREODctQTQzQS0yNjM3QkVFNDk0MDd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy43MCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTI2ODgxMjc5MSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyNjg5NjkwMzEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTk2MTU2NTExIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9mODEzNjkwMS1jNWYwLTQzMjYtYmYzMy00ZDczYjg3YTE5Nzk_UDE9MTczMzM2NjYzNSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1MaFZFRGZVdlE1VXd2NGRVJTJiSE14aDhsbmRPMlV1THpUaGttZTFyc1RhTHI5d2tuQzgyR1U1VHI1ajdIQnZiYWIlMmJoWm1pa0tNbnpTRGE2OXM1bjdZdGclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzY2MjIxNjAiIHRvdGFsPSIxNzY2MjIxNjAiIGRvd25sb2FkX3RpbWVfbXM9IjI2MDQ3Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTU5NjE1NjUxMSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2MDkyODIwOTUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjYyMTY5MzgxNTkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI2NzEiIGRvd25sb2FkX3RpbWVfbXM9IjMyNzAzIiBkb3dubG9hZGVkPSIxNzY2MjIxNjAiIHRvdGFsPSIxNzY2MjIxNjAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjYwNzY2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks system information in the registry
                      • System Location Discovery: System Language Discovery
                      • System Network Configuration Discovery: Internet Connection Discovery
                      PID:4304
                  • C:\ProgramData\WinRar.exe
                    C:\ProgramData\WinRar.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:1712
                    • C:\ProgramData\WinRar.exe
                      "C:\ProgramData\WinRar.exe"
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:1592
                  • C:\ProgramData\WinRar.exe
                    C:\ProgramData\WinRar.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    PID:4708
                    • C:\ProgramData\WinRar.exe
                      "C:\ProgramData\WinRar.exe"
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4760
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:2744
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:5328

                      Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            1
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            2
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Image File Execution Options Injection

                            1
                            T1546.012

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            2
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Image File Execution Options Injection

                            1
                            T1546.012

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Defense Evasion

                            Hide Artifacts

                            1
                            T1564

                            Hidden Files and Directories

                            1
                            T1564.001

                            Modify Registry

                            2
                            T1112

                            Credential Access

                            Discovery

                            Network Share Discovery

                            1
                            T1135

                            Peripheral Device Discovery

                            2
                            T1120

                            Query Registry

                            6
                            T1012

                            System Information Discovery

                            7
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            System Network Configuration Discovery

                            1
                            T1016

                            Internet Connection Discovery

                            1
                            T1016.001

                            Lateral Movement

                            Collection

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            e582dd2.rbs
                            • Path C:\Config.Msi\e582dd2.rbs
                            • Size 17KB
                            • SHA256 74ed2f77bebf8dd85639d2a6988b557313aef2e16f41c4d817fb0dd5050fd5ed
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            setup.exe
                            • Path C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.70\Installer\setup.exe
                            • Size 6.6MB
                            • SHA256 c4b55f6e4150ef16f731a7b10012eecb83b5557ae45ac2b3d37b7865d69d1b26
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            EdgeUpdate.dat
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\EdgeUpdate.dat
                            • Size 12KB
                            • SHA256 3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MicrosoftEdgeComRegisterShellARM64.exe
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                            • Size 182KB
                            • SHA256 6474d531f1b8788451f9a0d9e421dfa236279466c09d783c3e6bdadf7306b909
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MicrosoftEdgeUpdate.exe
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\MicrosoftEdgeUpdate.exe
                            • Size 201KB
                            • SHA256 f04efee822f9b2baf2f9b4ea576b9908804b6990497b82c549a34ba54b1b4807
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MicrosoftEdgeUpdateComRegisterShell64.exe
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                            • Size 215KB
                            • SHA256 16f4836dfd0647421e492b789928b5aa116f74b85ca91b46ba5873890d008334
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MicrosoftEdgeUpdateCore.exe
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\MicrosoftEdgeUpdateCore.exe
                            • Size 262KB
                            • SHA256 a8ce896d4e64a0246b1cfbba3d3f39a11350c017c7dc19e5bc4dabf0109fb0ef
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            NOTICE.TXT
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\NOTICE.TXT
                            • Size 4KB
                            • SHA256 91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdate.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdate.dll
                            • Size 2.1MB
                            • SHA256 17c62e9ed5bebdcce2ac0cb41a255c5f63f6544fb5ab148b6810617b854f6319
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_af.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_af.dll
                            • Size 29KB
                            • SHA256 6dc5593c42c16ebc1765afa6e8ef2af3fac6602a62197e0d614be330109e74cb
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_am.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_am.dll
                            • Size 24KB
                            • SHA256 fc8ef54504842074382f27576a36c7437429cfb876ad5b5332160a8e26255f1c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_ar.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_ar.dll
                            • Size 26KB
                            • SHA256 07718806c8a31133868cffaee5a07ca721e4f4c6ae4fd0deef67ef2a29eefae8
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_as.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_as.dll
                            • Size 29KB
                            • SHA256 b8a2774f687eaa0f25da96e7cf1497d5e6d84e567f7d0c89d5bd33931b2674fa
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_az.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_az.dll
                            • Size 29KB
                            • SHA256 27035173c82bde66600ee0cea45d98f6c000575b7deb9e670346a521caababab
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_bg.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_bg.dll
                            • Size 29KB
                            • SHA256 ac722db8cd409584c7529b4791773b56454d91c404222c7e9bc3f8a4d4aec448
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_bn-IN.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_bn-IN.dll
                            • Size 29KB
                            • SHA256 6ef242c7e8d2b1002f739cbf5485afd67c4972e36042c26b8dfd0133ae5122d5
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_bn.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_bn.dll
                            • Size 29KB
                            • SHA256 08383c9fa45d4c1fe441cb259fa0722b55ec2236e8dea471e380fb4fa35977a1
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_bs.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_bs.dll
                            • Size 29KB
                            • SHA256 dff265bd7a3a50bd18212d9c58f1a61e32c6821e520e20e5d8a929fffd8ed65b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_ca-Es-VALENCIA.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                            • Size 30KB
                            • SHA256 20e69e1f8ddf7282d90b1c1c7593d7d3593eebb2e72b98bdd26d4c7a560cfecd
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_ca.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_ca.dll
                            • Size 30KB
                            • SHA256 3a5464f9dcbbdaa0248906a5595b7247fb59ac3eb1f3f22b27bb095430de8843
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_cs.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_cs.dll
                            • Size 28KB
                            • SHA256 643163c67aa0f4e145c34a34e8fbf93a1a5779f8ebb30a91ac07032813695131
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_cy.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_cy.dll
                            • Size 28KB
                            • SHA256 edf8f2c128e9c73553aff7b06dc0c91a05adf576d4970715dc1f168ed233c1ad
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_da.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_da.dll
                            • Size 29KB
                            • SHA256 72538c238927c342f953beb6b7e2b7423e75d12b0ca5c33d4e1d8701e890badd
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_de.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_de.dll
                            • Size 31KB
                            • SHA256 7e06b7c22830140dcb56c0277541e789d115743e49c9410e6055f320bb88bbbc
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_el.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_el.dll
                            • Size 31KB
                            • SHA256 a845cf8f671920b538138717f40abddc5c830da4543cd9f7261245c3e3918824
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_en-GB.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_en-GB.dll
                            • Size 27KB
                            • SHA256 56fa3d934380c73b1e1c32a2bdeed64a26fc2de92612a201ef7306d4a00be0c8
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_en.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_en.dll
                            • Size 27KB
                            • SHA256 bdb3e5dbb6caa9fb77e23e1b5a363400402a6e88eed3e86e55bc9edae8b8bfad
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_es-419.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_es-419.dll
                            • Size 29KB
                            • SHA256 34e3bd8b21adc60adc614ce32a39dd424acc7c998f8d7901af5193348830b84f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_es.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_es.dll
                            • Size 29KB
                            • SHA256 9457f8915b6f1f644274c30f63831ebace766796cc9d570ed75575fd1dd88106
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_et.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_et.dll
                            • Size 28KB
                            • SHA256 224aa029d124cccac05d1c38dd7db1ae46fd17fdbe29c32692cd6dd4e1666728
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_eu.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_eu.dll
                            • Size 29KB
                            • SHA256 4db5fd9c0ccbbad69b90834e496a625fac6b479f561e2ecbdc2b5ee63ad35c66
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_fa.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_fa.dll
                            • Size 28KB
                            • SHA256 fcf333ce3065f755cf0033ee385a7f752132274a8c85da12ba5445f496875aac
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_fi.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_fi.dll
                            • Size 28KB
                            • SHA256 9fabe5d1abb1baa74b18d41ff28913b3eb9c3fa985f4335b36623463c0c7c09f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_fil.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_fil.dll
                            • Size 29KB
                            • SHA256 fda26d0135a07a7512811a8ad206056db70e0ea0fe9236096f2f622305e590c2
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_fr-CA.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_fr-CA.dll
                            • Size 30KB
                            • SHA256 fe20198950089e92c74d42eb0353119165cc64ca4abc98446d73f0afd4757662
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_fr.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_fr.dll
                            • Size 30KB
                            • SHA256 138e5dc802fdf6072d6420521908a5951b16d62de318819a344e2bf615ba071c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_ga.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_ga.dll
                            • Size 29KB
                            • SHA256 e524a448471455deed6635a2163ca334898494c2c8e7dafc8f82fa64b870680e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_gd.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_gd.dll
                            • Size 30KB
                            • SHA256 589178a57e5b434aef8df88f846f4baeeb0e8609452daca455e6978833235000
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_gl.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_gl.dll
                            • Size 29KB
                            • SHA256 64dd61bc661928249ca6de8074458f90ef7043c6687c223d99aaa69b41279ef0
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_gu.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_gu.dll
                            • Size 29KB
                            • SHA256 cfda4b12f03e0ca8dd1a208a3882b8c51ac1833d8f6b5677c707bb6a21a71f16
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_hi.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_hi.dll
                            • Size 29KB
                            • SHA256 f827ea5b8dd6a90eceb72ef944706be65196c61c8c1b611497fe323c3e6addd3
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_hr.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_hr.dll
                            • Size 29KB
                            • SHA256 0d5168dcc701ab29bc81346a3e9dae92a0dfdf39275d46c9b9484c7654d6c38d
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_hu.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_hu.dll
                            • Size 29KB
                            • SHA256 89fe1cb0139d4c4901ddafe903a7662fc1d6309d88bf9ea30c88da5ed393a062
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_id.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_id.dll
                            • Size 28KB
                            • SHA256 8c679bb053da4d3eb1704526bde8e2556b7bd1accd4ef1d53453f0b62fede6d1
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_is.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_is.dll
                            • Size 28KB
                            • SHA256 3b146d29a75d6ae40db7ea5cd78529a8a3d74e249abecd2103be306780ced845
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            msedgeupdateres_it.dll
                            • Path C:\Program Files (x86)\Microsoft\Temp\EU51D4.tmp\msedgeupdateres_it.dll
                            • Size 30KB
                            • SHA256 41e09ecabacfe4a39e11d2ef3eeac600889b1484a57e0a56f54140c2e26c3890
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            EZFN Launcher.exe
                            • Path C:\Program Files\EZFN Launcher\EZFN Launcher.exe
                            • Size 9.3MB
                            • SHA256 49bf997c7c1b051828ac8f30467eb0e5e12fee50cebe34c9b2f8c938a2a6481d
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            settings.dat
                            • Path C:\Program Files\MsEdgeCrashpad\settings.dat
                            • Size 280B
                            • SHA256 012600d19ef9dba736b9ea6eb2f37a7cff1bb1e35f8b00a4204ed9fe83bb146b
                            • MD5 SHA1 SHA512
                            Submit Download

                            MicrosoftEdgeUpdate.log
                            • Path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                            • Size 62KB
                            • SHA256 449b95f2078fe401e3b0210b4c6d1f6540ec2fcd8e8a1dd6eb4a3bcbfba90c84
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            EZFN Launcher.lnk
                            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk
                            • Size 2KB
                            • SHA256 17971791a606d0754cf1bac190f278bdb44d53a2fe7ca16a7662c971dddeabd7
                            • MD5 SHA1 SHA512
                            Submit Download

                            EZFN Launcher.lnk~RFe583033.TMP
                            • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk~RFe583033.TMP
                            • Size 1KB
                            • SHA256 2b44603bfac86d259177327d1d4b808fdc90d1985cd60f631a80f0bb53b08b6c
                            • MD5 SHA1 SHA512
                            Submit Download

                            WinRAR.exe.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WinRAR.exe.log
                            • Size 425B
                            • SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
                            • MD5 SHA1 SHA512
                            Submit Download

                            powershell.exe.log
                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                            • Size 2KB
                            • SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
                            • MD5 SHA1 SHA512
                            Submit Download

                            settings.dat
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            • Size 152B
                            • SHA256 6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
                            • MD5 SHA1 SHA512
                            Submit Download

                            settings.dat
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            • Size 152B
                            • SHA256 5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
                            • MD5 SHA1 SHA512
                            Submit Download

                            Preferences
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            • Size 5KB
                            • SHA256 9ab4dbf15273a701485ff1050bd6ad379e06b9b6d3560f538ff10ac6260a9a6b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 18KB
                            • SHA256 a43d6c802e21e7ccf38a46519d279fcba6528f0950038b28f4d2f6460ea3335e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 18KB
                            • SHA256 52f0e1ef5bc3d3a86e61e2b5452616a0fcbac597ee4d67ac321d620b080adccd
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 18KB
                            • SHA256 26c232b1869a6f21df961174066659815e8f6ffd1cf6a11d2941d90dcf52b95e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 18KB
                            • SHA256 dc7288582769562cda98951bb1eaada95cc2897b667bad8f34719f75ed1d9128
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MSIE0AB.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\MSIE0AB.tmp
                            • Size 113KB
                            • SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            MicrosoftEdgeWebview2Setup.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
                            • Size 1.6MB
                            • SHA256 09c2a441a22186cbcc90e0a79556c4c696446740955c9031f8b52e84c7cd4ec1
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            __PSScriptPolicyTest_3ep50f1p.vid.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ep50f1p.vid.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512
                            Submit Download

                            settings.dat
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 344b85103017d3b8d4a502a749664e94b167eb15df9d55122ead911e0d2e2f78
                            • MD5 SHA1 SHA512
                            Submit Download

                            CURRENT
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Extension Rules\CURRENT
                            • Size 16B
                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                            • MD5 SHA1 SHA512
                            Submit Download

                            MANIFEST-000001
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Extension Rules\MANIFEST-000001
                            • Size 41B
                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                            • MD5 SHA1 SHA512
                            Submit Download

                            SCT Auditing Pending Reports
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512
                            Submit Download

                            data_0
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_0
                            • Size 8KB
                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_1
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_1
                            • Size 264KB
                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_2
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_2
                            • Size 8KB
                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_3
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_3
                            • Size 8KB
                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
                            • Size 2KB
                            • SHA256 b3a9253f210c25c9a9d8c7c3522988d150bd9ef7661fb36a9a326c22e713118d
                            • MD5 SHA1 SHA512
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
                            • Size 3KB
                            • SHA256 d8af06fb6c6e84454b9c67bfd4c2d8d1c8fc7f09577d21acb7cc4f0b14e717c6
                            • MD5 SHA1 SHA512
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
                            • Size 1KB
                            • SHA256 b3ffbb9c51f3852df2fea0f3b78614c1a23f10e93aaa286db72620d711889f65
                            • MD5 SHA1 SHA512
                            Submit Download

                            Local State~RFe59e8ef.TMP
                            • Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State~RFe59e8ef.TMP
                            • Size 1KB
                            • SHA256 db7556548f6e30ab75a58e47499bd20b57b3a27f6650d9b2366ffc25e65af510
                            • MD5 SHA1 SHA512
                            Submit Download

                            EZFN Launcher_1.2.7_x64_en-US (1).msi
                            • Path C:\Users\Admin\AppData\Roaming\EZFN Launcher_1.2.7_x64_en-US (1).msi
                            • Size 7.5MB
                            • SHA256 b244361e1dac8d917be21d8e8453112c461f69ff3ec00e1844f6536379b8cd7f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Microsoft Teams.exe
                            • Path C:\Users\Admin\AppData\Roaming\Microsoft Teams.exe
                            • Size 3.3MB
                            • SHA256 589e6cc7481b257d46466116096f4df95a41daaca908a661a528dd3b658e4ea2
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            WinRAR.exe
                            • Path C:\Users\Admin\AppData\Roaming\WinRAR.exe
                            • Size 379KB
                            • SHA256 4963d8ea74645cc1931e28c1e6a378bce443d0e719d54ba61a1e100a93cdba4f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            metadata-2
                            • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                            • Size 24.1MB
                            • SHA256 e3d2ef5ed452eeb6eeac199749c62abb120f6171b8e68740f38c6c5d555e7ab2
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            {f1a0ab58-8e2a-4258-b395-1c454eca3332}_OnDiskSnapshotProp
                            • Path \??\Volume{fb297ba4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f1a0ab58-8e2a-4258-b395-1c454eca3332}_OnDiskSnapshotProp
                            • Size 6KB
                            • SHA256 1786342e431920e92506fd3c257285a99761ef0b2c68f313d00107201edb6568
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            memory/232-203-0x0000016AFDE50000-0x0000016AFDE72000-memory.dmp
                            Download

                            memory/744-1-0x0000000000010000-0x0000000000B5C000-memory.dmp
                            Download

                            memory/744-0-0x00007FFB476E3000-0x00007FFB476E5000-memory.dmp
                            Download

                            memory/784-465-0x0000000000400000-0x0000000000435000-memory.dmp
                            Download

                            memory/784-434-0x000000006F9C0000-0x000000006FBE6000-memory.dmp
                            Download

                            memory/784-399-0x000000006F9C0000-0x000000006FBE6000-memory.dmp
                            Download

                            memory/784-398-0x0000000000400000-0x0000000000435000-memory.dmp
                            Download

                            memory/1712-139-0x000000006F700000-0x000000006F74C000-memory.dmp
                            Download

                            memory/1900-493-0x00007FFB64A30000-0x00007FFB64A31000-memory.dmp
                            Download

                            memory/2444-107-0x0000000005470000-0x00000000057C4000-memory.dmp
                            Download

                            memory/2444-118-0x000000006F700000-0x000000006F74C000-memory.dmp
                            Download

                            memory/2880-542-0x00007FFB64A30000-0x00007FFB64A31000-memory.dmp
                            Download

                            memory/3552-32-0x0000000000C90000-0x00000000016F5000-memory.dmp
                            Download

                            memory/3552-20-0x0000000000C90000-0x00000000016F5000-memory.dmp
                            Download

                            memory/4136-81-0x0000000007860000-0x0000000007868000-memory.dmp
                            Download

                            memory/4136-59-0x0000000006820000-0x000000000686C000-memory.dmp
                            Download

                            memory/4136-80-0x0000000007880000-0x000000000789A000-memory.dmp
                            Download

                            memory/4136-79-0x0000000007780000-0x0000000007794000-memory.dmp
                            Download

                            memory/4136-78-0x0000000007770000-0x000000000777E000-memory.dmp
                            Download

                            memory/4136-77-0x0000000007740000-0x0000000007751000-memory.dmp
                            Download

                            memory/4136-76-0x00000000077C0000-0x0000000007856000-memory.dmp
                            Download

                            memory/4136-44-0x00000000028F0000-0x0000000002926000-memory.dmp
                            Download

                            memory/4136-45-0x0000000005330000-0x0000000005958000-memory.dmp
                            Download

                            memory/4136-46-0x0000000005990000-0x00000000059B2000-memory.dmp
                            Download

                            memory/4136-47-0x0000000005A30000-0x0000000005A96000-memory.dmp
                            Download

                            memory/4136-75-0x00000000075B0000-0x00000000075BA000-memory.dmp
                            Download

                            memory/4136-74-0x0000000007540000-0x000000000755A000-memory.dmp
                            Download

                            memory/4136-57-0x0000000005C40000-0x0000000005F94000-memory.dmp
                            Download

                            memory/4136-58-0x0000000006210000-0x000000000622E000-memory.dmp
                            Download

                            memory/4136-73-0x0000000007B80000-0x00000000081FA000-memory.dmp
                            Download

                            memory/4136-60-0x00000000067B0000-0x00000000067E2000-memory.dmp
                            Download

                            memory/4136-71-0x0000000006780000-0x000000000679E000-memory.dmp
                            Download

                            memory/4136-61-0x000000006F700000-0x000000006F74C000-memory.dmp
                            Download

                            memory/4136-72-0x0000000007400000-0x00000000074A3000-memory.dmp
                            Download

                            memory/4328-501-0x00007FFB63960000-0x00007FFB63961000-memory.dmp
                            Download

                            memory/4328-502-0x00007FFB63970000-0x00007FFB63971000-memory.dmp
                            Download

                            memory/4412-43-0x0000000005450000-0x00000000054B6000-memory.dmp
                            Download

                            memory/4412-38-0x00000000053B0000-0x000000000544C000-memory.dmp
                            Download

                            memory/4412-34-0x0000000000400000-0x0000000000438000-memory.dmp
                            Download

                            memory/4840-26-0x0000000074F1E000-0x0000000074F1F000-memory.dmp
                            Download

                            memory/4840-33-0x0000000074F1E000-0x0000000074F1F000-memory.dmp
                            Download

                            memory/4840-30-0x0000000000490000-0x00000000004F4000-memory.dmp
                            Download

                            memory/4924-94-0x0000000006260000-0x00000000065B4000-memory.dmp
                            Download

                            memory/4924-96-0x000000006F700000-0x000000006F74C000-memory.dmp
                            Download