641082b5805ad60fe6493dd36bae8dfc390940bd1d15add162bef02345ff3f0e

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/04/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EZFNLauncher.msi
Size 7.1MB
Sample260418-y239faex3z
SHA256 641082b5805ad60fe6493dd36bae8dfc390940bd1d15add162bef02345ff3f0e
MD5 e418e4a9cb75024e14e1ec3e6e91e0a0
SHA1 6d82c663a6dcbe522c2cec7152be8acf53832196
SHA512 b921d77f1dafe44a6018c9552c3e216fd86cbd6e3e0c758dee0db3e7cb142c0178b8aad11dd2432696a121cb6d496b49431e79d8fe024afe58e987890a855c7d
SSDEEP 196608:FrBn5fZ9AA/AwF532R11xsNqe7I85IYYF1V:FLrdFgzsNB7I2IYY
TLSH
T157763323BE84493AE5B50E76993E97515B3CBD204A24C4EB0384760EDFF42D12E769F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4120	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
760	EZFN Launcher.exe
2964	EZFN Launcher.exe

Loads dropped DLL 2 IoCs

pid	Process
5084	MsiExec.exe
5084	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EZFN Launcher.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EZFN Launcher.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season6.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season15.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\EZFN Launcher.exe	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\default_skin.png	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season15.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season3.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season6.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season7.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season7.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\EZFN Launcher.exe	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season9.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season4.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season1.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season2.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season10.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season10.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season11.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season5.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season3.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season1.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season9.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season8.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season8.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season5.webp	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season4.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season11.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\season_images\Season2.webp	msiexec.exe
File created	C:\Program Files\EZFN Launcher\Uninstall EZFN Launcher.lnk	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\default_skin.png	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\Uninstall EZFN Launcher.lnk	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{4BB735E8-3588-4002-AEE1-43D83DEE70B5}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\am\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\{7F6C65EE-B4ED-4996-9201-7FC232803C8A}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_740649768\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\Installer\e58f7db.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\de\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3844_361800296\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI64CD.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\Installer\e58f7f3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\uk\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{4BB735E8-3588-4002-AEE1-43D83DEE70B5}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\Installer\e58f7da.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1920485344\deny_full_domains.list	msedge.exe
File created	C:\Windows\Installer\SourceHash{7F6C65EE-B4ED-4996-9201-7FC232803C8A}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\or\messages.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\Installer\e58f7d8.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3880_1822868425\_locales\es_419\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4932	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2684	msedge.exe
4944	msedge.exe

Checks SCSI registry key(s) 3 TTPs 17 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000097e81bb103c0c43a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380197e81bb10000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e8410197e81bb1000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6f97e81bb100000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7197e81bb100000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210171607395483"	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\DefaultIcon	EZFN Launcher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE56C6F7DE4B69942910F72C2308C3A8\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList\PackageName = "EZFN Launcher_1.3.4_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\shell\open\command	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B\MainProgram	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-262299150-3324607021-1566776428-1000\{26345C89-9179-422B-A7DC-E69C5044C2ED}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\shell\open\command\ = "C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe \"%1\""	EZFN Launcher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\shell\open\command\ = "\"C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe\" \"%1\""	EZFN Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-262299150-3324607021-1566776428-1000\{F5066D0B-B3BE-4070-B892-8272A3E1FBC9}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\.tmpJTqsIT\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\DefaultIcon	EZFN Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\DefaultIcon\ = "C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe,0"	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\PackageCode = "6DCBEC1DFAF579E49B5C05DC7D09838B"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\shell	EZFN Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\Version = "16973828"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8E537BB488532004EA1E348DD3EE075B\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\Version = "16908293"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\ = "URL:org.ezfn"	EZFN Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\shell\open	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\ProductName = "EZFN Launcher"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298\EE56C6F7DE4B69942910F72C2308C3A8	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\DefaultIcon\ = "C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe,0"	EZFN Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\shell\open\command	EZFN Launcher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE56C6F7DE4B69942910F72C2308C3A8\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE56C6F7DE4B69942910F72C2308C3A8\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\.tmpJTqsIT\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\PackageCode = "D03B14B87900F2546A11B9257902A0CA"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\PackageName = "EZFNLauncher.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\ = "URL:org.ezfn protocol"	EZFN Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\ProductIcon = "C:\\Windows\\Installer\\{4BB735E8-3588-4002-AEE1-43D83DEE70B5}\\ProductIcon"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn\URL Protocol	EZFN Launcher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8E537BB488532004EA1E348DD3EE075B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE56C6F7DE4B69942910F72C2308C3A8\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn	EZFN Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\ezfn	EZFN Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4928	msiexec.exe
4928	msiexec.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe
760	EZFN Launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2364	msedgewebview2.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
3844	msedgewebview2.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe
3880	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4932	msiexec.exe
Token: SeSecurityPrivilege	4928	msiexec.exe
Token: SeCreateTokenPrivilege	4932	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4932	msiexec.exe
Token: SeLockMemoryPrivilege	4932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4932	msiexec.exe
Token: SeMachineAccountPrivilege	4932	msiexec.exe
Token: SeTcbPrivilege	4932	msiexec.exe
Token: SeSecurityPrivilege	4932	msiexec.exe
Token: SeTakeOwnershipPrivilege	4932	msiexec.exe
Token: SeLoadDriverPrivilege	4932	msiexec.exe
Token: SeSystemProfilePrivilege	4932	msiexec.exe
Token: SeSystemtimePrivilege	4932	msiexec.exe
Token: SeProfSingleProcessPrivilege	4932	msiexec.exe
Token: SeIncBasePriorityPrivilege	4932	msiexec.exe
Token: SeCreatePagefilePrivilege	4932	msiexec.exe
Token: SeCreatePermanentPrivilege	4932	msiexec.exe
Token: SeBackupPrivilege	4932	msiexec.exe
Token: SeRestorePrivilege	4932	msiexec.exe
Token: SeShutdownPrivilege	4932	msiexec.exe
Token: SeDebugPrivilege	4932	msiexec.exe
Token: SeAuditPrivilege	4932	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4932	msiexec.exe
Token: SeChangeNotifyPrivilege	4932	msiexec.exe
Token: SeRemoteShutdownPrivilege	4932	msiexec.exe
Token: SeUndockPrivilege	4932	msiexec.exe
Token: SeSyncAgentPrivilege	4932	msiexec.exe
Token: SeEnableDelegationPrivilege	4932	msiexec.exe
Token: SeManageVolumePrivilege	4932	msiexec.exe
Token: SeImpersonatePrivilege	4932	msiexec.exe
Token: SeCreateGlobalPrivilege	4932	msiexec.exe
Token: SeCreateTokenPrivilege	4932	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4932	msiexec.exe
Token: SeLockMemoryPrivilege	4932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4932	msiexec.exe
Token: SeMachineAccountPrivilege	4932	msiexec.exe
Token: SeTcbPrivilege	4932	msiexec.exe
Token: SeSecurityPrivilege	4932	msiexec.exe
Token: SeTakeOwnershipPrivilege	4932	msiexec.exe
Token: SeLoadDriverPrivilege	4932	msiexec.exe
Token: SeSystemProfilePrivilege	4932	msiexec.exe
Token: SeSystemtimePrivilege	4932	msiexec.exe
Token: SeProfSingleProcessPrivilege	4932	msiexec.exe
Token: SeIncBasePriorityPrivilege	4932	msiexec.exe
Token: SeCreatePagefilePrivilege	4932	msiexec.exe
Token: SeCreatePermanentPrivilege	4932	msiexec.exe
Token: SeBackupPrivilege	4932	msiexec.exe
Token: SeRestorePrivilege	4932	msiexec.exe
Token: SeShutdownPrivilege	4932	msiexec.exe
Token: SeDebugPrivilege	4932	msiexec.exe
Token: SeAuditPrivilege	4932	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4932	msiexec.exe
Token: SeChangeNotifyPrivilege	4932	msiexec.exe
Token: SeRemoteShutdownPrivilege	4932	msiexec.exe
Token: SeUndockPrivilege	4932	msiexec.exe
Token: SeSyncAgentPrivilege	4932	msiexec.exe
Token: SeEnableDelegationPrivilege	4932	msiexec.exe
Token: SeManageVolumePrivilege	4932	msiexec.exe
Token: SeImpersonatePrivilege	4932	msiexec.exe
Token: SeCreateGlobalPrivilege	4932	msiexec.exe
Token: SeCreateTokenPrivilege	4932	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4932	msiexec.exe
Token: SeLockMemoryPrivilege	4932	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
4932	msiexec.exe
760	EZFN Launcher.exe
4932	msiexec.exe
5156	msedge.exe
5156	msedge.exe
4968	msiexec.exe
4968	msiexec.exe
2964	EZFN Launcher.exe
3880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 5084	4928	msiexec.exe	86
PID 4928 wrote to memory of 5168	4928	msiexec.exe	96
PID 5084 wrote to memory of 760	5084	MsiExec.exe	101
PID 760 wrote to memory of 2364	760	EZFN Launcher.exe	102
PID 2364 wrote to memory of 1312	2364	msedgewebview2.exe	103
PID 2364 wrote to memory of 1444	2364	msedgewebview2.exe	104
PID 2364 wrote to memory of 1444	2364	msedgewebview2.exe	104
PID 2364 wrote to memory of 1444	2364	msedgewebview2.exe	104
PID 2364 wrote to memory of 3932	2364	msedgewebview2.exe	105
PID 2364 wrote to memory of 1516	2364	msedgewebview2.exe	106
PID 2364 wrote to memory of 1516	2364	msedgewebview2.exe	106
PID 2364 wrote to memory of 1508	2364	msedgewebview2.exe	107
PID 2364 wrote to memory of 1508	2364	msedgewebview2.exe	107
PID 2364 wrote to memory of 1508	2364	msedgewebview2.exe	107
PID 760 wrote to memory of 5156	760	EZFN Launcher.exe	108
PID 5156 wrote to memory of 4708	5156	msedge.exe	109
PID 5156 wrote to memory of 2684	5156	msedge.exe	111
PID 5156 wrote to memory of 1880	5156	msedge.exe	112
PID 5156 wrote to memory of 1880	5156	msedge.exe	112
PID 5156 wrote to memory of 1880	5156	msedge.exe	112
PID 5156 wrote to memory of 1952	5156	msedge.exe	113
PID 5156 wrote to memory of 1952	5156	msedge.exe	113
PID 5156 wrote to memory of 5420	5156	msedge.exe	115
PID 5156 wrote to memory of 5112	5156	msedge.exe	114
PID 5156 wrote to memory of 5420	5156	msedge.exe	115
PID 5156 wrote to memory of 5420	5156	msedge.exe	115
PID 5156 wrote to memory of 5112	5156	msedge.exe	114
PID 5156 wrote to memory of 5112	5156	msedge.exe	114
PID 5156 wrote to memory of 4144	5156	msedge.exe	119
PID 5156 wrote to memory of 4144	5156	msedge.exe	119
PID 5156 wrote to memory of 4144	5156	msedge.exe	119
PID 5156 wrote to memory of 4596	5156	msedge.exe	120
PID 5156 wrote to memory of 4596	5156	msedge.exe	120
PID 5156 wrote to memory of 4596	5156	msedge.exe	120
PID 5156 wrote to memory of 5920	5156	msedge.exe	121
PID 5156 wrote to memory of 5920	5156	msedge.exe	121
PID 5156 wrote to memory of 4496	5156	msedge.exe	122
PID 5156 wrote to memory of 4496	5156	msedge.exe	122
PID 5156 wrote to memory of 4568	5156	msedge.exe	124
PID 5156 wrote to memory of 3880	5156	msedge.exe	125
PID 3880 wrote to memory of 5508	3880	msedge.exe	126
PID 3880 wrote to memory of 4944	3880	msedge.exe	128
PID 3880 wrote to memory of 4836	3880	msedge.exe	129
PID 3880 wrote to memory of 4836	3880	msedge.exe	129
PID 3880 wrote to memory of 4836	3880	msedge.exe	129
PID 3880 wrote to memory of 4128	3880	msedge.exe	131
PID 3880 wrote to memory of 4128	3880	msedge.exe	131
PID 3880 wrote to memory of 1896	3880	msedge.exe	134
PID 760 wrote to memory of 4120	760	EZFN Launcher.exe	135
PID 4120 wrote to memory of 4968	4120	powershell.exe	137
PID 4120 wrote to memory of 2964	4120	powershell.exe	138
PID 2964 wrote to memory of 3844	2964	EZFN Launcher.exe	140
PID 3844 wrote to memory of 1836	3844	msedgewebview2.exe	141
PID 3844 wrote to memory of 4868	3844	msedgewebview2.exe	142
PID 3844 wrote to memory of 4868	3844	msedgewebview2.exe	142
PID 3844 wrote to memory of 4868	3844	msedgewebview2.exe	142
PID 3844 wrote to memory of 3548	3844	msedgewebview2.exe	143
PID 3844 wrote to memory of 4472	3844	msedgewebview2.exe	144
PID 3844 wrote to memory of 4472	3844	msedgewebview2.exe	144
PID 3844 wrote to memory of 2744	3844	msedgewebview2.exe	145
PID 3844 wrote to memory of 2744	3844	msedgewebview2.exe	145
PID 3844 wrote to memory of 2744	3844	msedgewebview2.exe	145
PID 2964 wrote to memory of 3712	2964	EZFN Launcher.exe	146
PID 3712 wrote to memory of 5104	3712	msedge.exe	147

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EZFNLauncher.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4932

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B52A2B5F811EC6DC595E8C23C3DA2020 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Program Files\EZFN Launcher\EZFN Launcher.exe
    "C:\Program Files\EZFN Launcher\EZFN Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.5 --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --no-proxy-server --lang=en-US --mojo-named-platform-channel-pipe=760.856.9775730909525898947
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2364
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa452db078,0x7ffa452db084,0x7ffa452db090
        5⤵
        
        PID:1312
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1788,i,12483551692968255029,15644274492632587276,262144 --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
        5⤵
        
        PID:1444
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2080,i,12483551692968255029,15644274492632587276,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:3
        5⤵
        
        PID:3932
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2260,i,12483551692968255029,15644274492632587276,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
        5⤵
        
        PID:1516
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3168,i,12483551692968255029,15644274492632587276,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
        5⤵
        
        PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
      4⤵
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x334,0x7ffa4303c188,0x7ffa4303c194,0x7ffa4303c1a0
        5⤵
        
        PID:4708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,13102101328825477976,12702415597696782688,524288 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:2684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,3554713692922275308,9319929779340838754,262144 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
        5⤵
        
        PID:1880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,12536178488637769242,14686273257690346893,524288 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
        5⤵
        
        PID:1952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,10832956285385751459,12922479677826657086,2097152 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        
        PID:5112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10733069877896147570,3021969780099915119,2097152 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        5⤵
        
        PID:5420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4840,i,1816731348875637656,10592051139887513164,2097152 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
        5⤵
        
        PID:4144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4776,i,13046100773527340325,5118783772114633856,2097152 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,10789133047922148573,11264511672276117057,524288 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
        5⤵
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,2411445837698314630,4012287378704285149,524288 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
        5⤵
        
        PID:4496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,16364426070973222358,2892299150805987430,524288 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
        5⤵
        
        PID:5692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,16364426070973222358,2892299150805987430,524288 --field-trial-handle=2348,i,18337288572616366633,13834790930119667450,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
        5⤵
        
        PID:4568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffa4303c188,0x7ffa4303c194,0x7ffa4303c1a0
        6⤵
        
        PID:5508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,11744635083593088337,10266169900223119818,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:4944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,997330591568307212,2875898857675925589,262144 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
        6⤵
        
        PID:4836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,6378331653128873423,8388447592331091422,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:8
        6⤵
        
        PID:4128
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,582744710317441881,1947735280618829048,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
        6⤵
        
        PID:4132
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,582744710317441881,1947735280618829048,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
        6⤵
        
        PID:1896
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4844,i,11397835402168225855,6996239179472113072,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
        6⤵
        
        PID:5984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4840,i,8750963156600298124,6667442685947041529,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
        6⤵
        
        PID:2984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,11775315802749818124,12993995581364479274,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
        6⤵
        
        PID:2552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,6612516751904848735,11939455296678971265,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
        6⤵
        
        PID:5176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5864,i,11528036731525776102,11197207041915749498,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
        6⤵
        
        PID:1492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5788,i,4205421989885233366,3012883441094011827,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
        6⤵
        
        PID:5992
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,9471964313450871245,2138025703234879776,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
        6⤵
        
        PID:184
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,9471964313450871245,2138025703234879776,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
        6⤵
        
        PID:3052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6564,i,17775338239779947331,16403709838892477931,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
        6⤵
        
        PID:6328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6760,i,14881736787384059410,12848059911881874594,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
        6⤵
        
        PID:6440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6336,i,3459378536636653542,8119624012972477500,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
        6⤵
        
        PID:6452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6908,i,15572345554695275129,9265774161313265315,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
        6⤵
        
        PID:6712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6952,i,1516680625330025482,59445506950591326,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
        6⤵
        
        PID:6756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6804,i,3992174458651854043,6927282764996906247,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
        6⤵
        
        PID:6840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6924,i,3169667807893605131,14495510780022096979,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
        6⤵
        
        PID:6904
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6704,i,3771274288516655657,12808183285146402195,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
        6⤵
        
        PID:6916
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,12166974564586273912,15214420845872265656,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
        6⤵
        
        PID:6640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,16510705396199640274,11658622869884521294,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
        6⤵
        
        PID:6628
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,12830305475580955825,9704830196914563839,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
        6⤵
        
        PID:6364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3160,i,8862122422633959551,7795052383850875341,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:8
        6⤵
        
        PID:6984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1840611486758595523,574972185868209786,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:8
        6⤵
        
        PID:6288
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,15337851127661362814,6912477498672677778,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
        6⤵
        
        PID:6852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7312,i,12691907568877569395,18446442910458913690,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
        6⤵
        
        PID:404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,1558913557692632632,15975617596806662622,524288 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
        6⤵
        
        PID:6352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5604,i,779984022951940861,5733259097357989590,2097152 --field-trial-handle=2320,i,15277587097878097036,17460083738520650924,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:1
        6⤵
        
        PID:6912
      - C:\Program Files\EZFN Launcher\EZFN Launcher.exe
        
        "C:\Program Files\EZFN Launcher\EZFN Launcher.exe" "ezfn://login/?accessToken=eg1~eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHAiOiJlemZuIiwic3ViIjoiMDAwYjE2Mjg3MjQyNGU3Y2I3NzVmYzdmMWMyOTA5ZjUiLCJtdmVyIjpmYWxzZSwiY2xpZCI6ImY4MzNhNzI5MmIwZjQ2M2VhMzhmOWMxYzAyMzRhNTQ0IiwiZG4iOiJoZWxsbzU2MSIsIm1sIjoiIiwiYW0iOiJwYXNzd29yZCIsInBmcGlkIjoicHJvZC1mbiIsInNpYSI6IjRlNjU2ZjZlNjk3NDY1Iiwic2VjIjoxLCJiIjpmYWxzZSwiY2xzdmMiOiJwcm9kLWZuIiwidCI6InMiLCJpYyI6dHJ1ZSwiZXhwIjoxNzc3MTQ4NDQzLCJpYXQiOjE3NzY1NDM2NDMsImp0aSI6IjQzMzJhMTgyZGEzZTQ3NjdhZWE5YzdmY2NhYWYzNWIzIiwiZHZpZCI6ImYwNDBjMmM5ZTZhYjRiNGRhNGE1M2E3ZWYwZjI2ZjAwIn0.SO6zJAje-Q0yCTk_Owz_7UF7BFud7xhVo2iMaR_ykuA&refreshToken=eg1~eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHAiOiJlemZuIiwic3ViIjoiMDAwYjE2Mjg3MjQyNGU3Y2I3NzVmYzdmMWMyOTA5ZjUiLCJtdmVyIjpmYWxzZSwiY2xpZCI6ImY4MzNhNzI5MmIwZjQ2M2VhMzhmOWMxYzAyMzRhNTQ0IiwiZG4iOiJoZWxsbzU2MSIsIm1sIjoiIiwiYW0iOiJwYXNzd29yZCIsInBmcGlkIjoicHJvZC1mbiIsInNpYSI6IjRlNjU2ZjZlNjk3NDY1Iiwic2VjIjoxLCJiIjpmYWxzZSwiY2xzdmMiOiJwcm9kLWZuIiwidCI6InMiLCJpYyI6dHJ1ZSwiZXhwIjoxNzc3MTQ4NDQzLCJpYXQiOjE3NzY1NDM2NDMsImp0aSI6IjQzMzJhMTgyZGEzZTQ3NjdhZWE5YzdmY2NhYWYzNWIzIiwiZHZpZCI6ImYwNDBjMmM5ZTZhYjRiNGRhNGE1M2E3ZWYwZjI2ZjAwIn0.SO6zJAje-Q0yCTk_Owz_7UF7BFud7xhVo2iMaR_ykuA"
        6⤵
        
        PID:6204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden Start-Process -Wait -FilePath $Env:SYSTEMROOT\System32\msiexec.exe -ArgumentList /i, "\"\"\"C:\Users\Admin\AppData\Local\Temp\.tmpJTqsIT\EZFN Launcher_1.3.4_x64_en-US.msi\"\"\"" ", /passive, /promptrestart;" Start-Process "\"C:\Program Files\EZFN Launcher\EZFN Launcher.exe\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\.tmpJTqsIT\EZFN Launcher_1.3.4_x64_en-US.msi" /passive /promptrestart
        5⤵
        Suspicious use of FindShellTrayWindow
        
        PID:4968
    - - C:\Program Files\EZFN Launcher\EZFN Launcher.exe
        
        "C:\Program Files\EZFN Launcher\EZFN Launcher.exe"
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2964
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --no-proxy-server --lang=en-US --mojo-named-platform-channel-pipe=2964.1880.4332205285695690661
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x188,0x18c,0x190,0x164,0x1bc,0x7ffa452db078,0x7ffa452db084,0x7ffa452db090
        7⤵
        
        PID:1836
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1836,i,7085440505192239421,11355258096007944788,262144 --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
        7⤵
        
        PID:4868
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2096,i,7085440505192239421,11355258096007944788,262144 --variations-seed-version --mojo-platform-channel-handle=1632 /prefetch:3
        7⤵
        
        PID:3548
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1964,i,7085440505192239421,11355258096007944788,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
        7⤵
        
        PID:4472
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3520,i,7085440505192239421,11355258096007944788,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
        7⤵
        
        PID:2744
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2216,i,7085440505192239421,11355258096007944788,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
        7⤵
        
        PID:6704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
        7⤵
        
        PID:5104
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5168

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58f7d9.rbs

Path C:\Config.Msi\e58f7d9.rbs
Size 17KB
SHA256 f08f4a516bc8554892ee92bc95bafcf01244f550b03b5e108a99312954b6de07
MD5 12d868cdf82e8acf2c69376a6f01a0f9
SHA1 374162269b306c61480cb2262ffa60c784a2a8d7
SHA512 891e0c3c61cf4b56f0797b7ec32317f7964aaa8c39191ae3d9dc1e2d406d229a8361e3c86616d2e13d502500ca9a718c61f243dd4dfc8225bc5e39eca02071d0
SSDEEP 384:L5l5eB/ihoUcJeKX8jKVztXtXtXtXtXtXtXtXtXtXt5IeI6As:L5l5eB/ihoUcJeKX8jKVztXtXtXtXtXB
TLSH
T1988222815B14C2C2E59F1378DB3B17203B73C2D897889B1B86CDA1319E667942FB961F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7e0.rbs

Path C:\Config.Msi\e58f7e0.rbs
Size 20KB
SHA256 f4253470111d4217de413afe16a12007fd28949215534080765e0f48886b5996
MD5 effad6054bbe00c134d4d594cf6515d2
SHA1 ae14fb11ea19f430d91ee5c30c512ccef42628c1
SHA512 ea65ba5cfb8609781af5d04387e586a7cd02b700ed1f74706d682418284c3d9950a3fefbe9c0db277a01a06e49df930c5ca59038702de77590ac70d1a1cf4955
SSDEEP 384:xbREyR24A3w5otKtXtTtTtTtTtTtTtTtTtTtTtTtJR:x1lC3w5otKtXtTtTtTtTtTtTtTtTtTt7
TLSH
T1A89200824714C2D3E59B2334DB3707203F73C6989788861786ECA1799EB67942FF960E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7e3.rbf

Path C:\Config.Msi\e58f7e3.rbf
Size 113KB
SHA256 05cb2152ce69c34f87a4deda4817269aa714b6ce4a8bcc3c60e7c1a4dc09540b
MD5 6ba56d5f6dadb5782428035f6a3cf998
SHA1 d58124b59f3a473415540d65a3b7b5b1b8233993
SHA512 928014c628dd55df040dedc0e1aecd5375acc0f1f958c0341140393cb85c83ebd419703cd0f752cb1ed1aa314a74b12b8a245a2b45d281c5f24c05514ec3e128
SSDEEP 3072:LdIU3gxRYPv1JJG7F9/G4sXJr3QpRpHBhg0bkL8llOa9AEG:ruYPv2vlr3ALna9VG
TLSH
T19EB302466CBFDD4872300152CF3F261B246FBE98003F88758486CAD66F52AB3596B6E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7e4.rbf

Path C:\Config.Msi\e58f7e4.rbf
Size 117KB
SHA256 15280307205c3a6b6551cd38981e263ede31708f40e7061b360ccad6eb3a4797
MD5 9b2118ee11bdcf459d02bc4a4f4a2965
SHA1 6316e69effc4627f88066bef8e146112083cb581
SHA512 4f6c6ebe925d64466a06db56737d8a3bf7e29fa377a3bbd29f0293d610898bf6773d1374713f496a175651585f6534f3b874c1e5e64498eba370f3cbc1381c59
SSDEEP 3072:bx88XRTVGeglOyqDi7eeaitrGlFeoRvrfWKsRxD4V6AAu:l88qsaNNoRvrfLsMV6AAu
TLSH
T1B2C312B727EF199E9425D36E31894DCF8DA874111CE1A76B270C31859E841334BDAEF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7e5.rbf

Path C:\Config.Msi\e58f7e5.rbf
Size 163KB
SHA256 d1acf91f644ba1877832f3a8315305c6d49a2a140b66cbded02c5017360786e4
MD5 335fb9c70f5039817bf345f77250fbd0
SHA1 c7dd318d7e47c23b9baae87ca723c6c73b6a48f5
SHA512 7185254d20b3eda40b138e55d713fd6813dc56cb2d66bf7eab6b14f5525d9bd8972c4df2dd1ddd4b43cdaaca405aba7c88559ada03f0bfa5a81f8bd0ac4a6559
SSDEEP 3072:SuKbWtbVVNOchOzAjzRNo2SMIwI1sY+OW+9yosxt3Wukvu+5EvrbrKBX:SuKbWtb3cch3zR2VMIwm5Iosxt3pkW+H
TLSH
T151F323CBD9AC2CA048F41822FD6F8059AB78DE397D2E90E3816D7C5017E64C64BAC0CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7e6.rbf

Path C:\Config.Msi\e58f7e6.rbf
Size 117KB
SHA256 1fd3b2a990717b40657916c5e085d8e2ad81da4b6813828ae7786307cd192f8f
MD5 b0b772a92dc56eca1733bcf7ce9f15e9
SHA1 e00a0ac66d019ec9929c69bfb2554dd9fdbe94d5
SHA512 b79394b809e998567ce8dc77089fa66cf3ac2889c5f8d56c5e7b825d3025cb0a363c0dc16add78a53696f6ccc9fb07db63c8ccba7e8f6728eaf14923c10365cf
SSDEEP 3072:piRB3cQzvauO7dONtkN2oVTn5JRrNlrFIN/+bzNNxZfY8/:piRB3LvaJY3kRVTfRrNli/uzBZA8/
TLSH
T1E8C31251272F81C2B4F137EE34CDBF6C473270894DB9281769758B4D2E127EAEDA8861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7e7.rbf

Path C:\Config.Msi\e58f7e7.rbf
Size 234KB
SHA256 caf02b9121c474e6422a2fa674df79ba1f35f60bd516a015d689cd01fdd80579
MD5 265393414b5bc850a63e3856d3158fd6
SHA1 940251e88cba5c93c92aa87572d05a94e5e0f193
SHA512 f75431f89d577801ce00ee523b3b1465d57fa37f8d943ac1b2ce487e500bed04fefb23d9bcd05d08a53beda72bfbfa939b3d41d1e620a0b446d6d5c2999eb820
SSDEEP 6144:RS2UjVEwQdPNE62TvF2H4FUaYfbA7ghQKMlECr6ayqnkCBxu:R5kSlP262TvFMmUaYfrzMrF
TLSH
T12134234FE7244C6AD0E90A1C6DD52DCA54DEF91E1058A2FD4FD066F78F8E4A12DC980A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7e8.rbf

Path C:\Config.Msi\e58f7e8.rbf
Size 93KB
SHA256 d0ec7369bfd90c4d8ac7a128ac22ecbe5e3c288ae2619e528e4ea64b2015a4a7
MD5 6810f96e95297f6c1cd3ae16f4c896ed
SHA1 a60877ef6563a18dcfbea5c96b510457491ba2b1
SHA512 ca128e860b345469209b5fb77f7db93d8346768271a61f1782caa6de942640f671dc7656f9dcc747d6d7a87215a85f511196d4eeae6aef19ea8c3a00bb55219e
SSDEEP 1536:L2MZWWA8u3Rw3T02A8orDUovBPJFya/2jsBxOVv0+RznNh+G4orJKiidjjvViyM9:L2SI8M63T02Wr/6a/2jb1b5o0r3iFMfl
TLSH
T1F593120F46416D6DD41124CDAAF16BEB40CA3EE62C8B57039BD15786F2AC8E3C17696C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7e9.rbf

Path C:\Config.Msi\e58f7e9.rbf
Size 94KB
SHA256 21de3019f43de27146198a3566dc0d4a20f8da6e5f357be819d8677b4b48d97e
MD5 3aae2bf0658b3f758401ad902e9dbe95
SHA1 db8e5f5ff60d4064254727a24df3f374c9459f9c
SHA512 c6b162fcfb2d539122f1e7118f5555de4ad9ca76e9830db521264f501f5bc1064c4eecf4050ea1dc5746beda07308f65fda0ea43e38a34d0e2f9a79bee66e809
SSDEEP 1536:PYOe8wUQYUwxm8nUckNmqqT5FHwiqHHcNo6ws+tXWyBeVAbjPI5Rde6vsfPI:Pc8wBYUmXWNmqmQi6MSsufeV6PI5R06f
TLSH
T1789312CA4626F1D38C1B5B96D3F99F374263AF120939687272199283E92FC15E113CF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7ea.rbf

Path C:\Config.Msi\e58f7ea.rbf
Size 103KB
SHA256 bc76023cb0af7ea8e881e84ac42f67ba0e1b9a426ce4fa4f3b5293fe86f6e58a
MD5 4f583ded879b40067fe5b146f41c4398
SHA1 161f33de2d6e756e0397de30cb158af75bc756fc
SHA512 4096875f06aaa0da837872e4acc471a8c8770a1356273cb813de6629f12ae74ea4997a5becfd204726e32edcaa50f9bd47aa5f5b3d3c39c409305e09822405e3
SSDEEP 3072:8amL5F7KLde0YllPNgtijD+pxH79L4bJQ:u5F1D9NCDd
TLSH
T1FEA3125DE5AD3BDE37F2C08C0E8AD5635FB8E947CFC72D4D12590F103A2A58A6682570
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7eb.rbf

Path C:\Config.Msi\e58f7eb.rbf
Size 109KB
SHA256 86e7e0c3f94e9dd442fc1829a42d02a1e152dd3d552b0279b7cd2dadef949846
MD5 dc8335f69d9da46e1a71cafc750b4a1d
SHA1 6fb68a6f89c593d32cdbddeb46ecaebd05af152b
SHA512 29bcc85f434cab415165664950ae2436b39b7a1252d5d66c3a25446872a0c61d28c93463fd15ab5224f59704e70adbd45697a013b9a6d561337bed0a47e395c6
SSDEEP 1536:6hbISfmh8wZXl0SSxnJPeCIzyLtPN3G3oCMLM25KtSohzjKgJsz9RPGI/PtiCOqy:6hbIgUhZbeJ2CI01302ERJ6RN39Tfsb
TLSH
T135B302096C6A54E3B2BB30E2D063630CE61D947484BCD75B22A075169CFCFA59DDE32D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7ec.rbf

Path C:\Config.Msi\e58f7ec.rbf
Size 124KB
SHA256 1e51ebb0c98ee8cc6a194dc5b08c940573c65bde2b580e88c0449658c49267f1
MD5 b112139e396ee16ac6f8d7f5dc5d10f7
SHA1 3e0362abe1e92fac0785e14557f8aaca6b840648
SHA512 f8376145bdae50192ab06d84efb703f18648b2d3125ab7ca91e9a9a693d5e6a44d00cb208456c2dc8552f5eca159aa11f730d971eed98062ea4f06a232501524
SSDEEP 3072:PDW1yEPP+w4W5r6cOWC05ufZYVig3xKZE4jermWdnWieojave:aoEPP+wVxPuc4EXAe
TLSH
T1CFC31229DF2AF3B470751DB39C394C12F0362CD945A1B5FAB81223065BA43E8038BEB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7ed.rbf

Path C:\Config.Msi\e58f7ed.rbf
Size 130KB
SHA256 c0d99858e848f4f84c8b87646a822c44dc46fbf131d416d2690b92ccca967fa0
MD5 2b6c2ed96432b2da3d2c597d3ea8b6d0
SHA1 a4a66a73fa29d09053fcadd89fb7188b0df5a76b
SHA512 c0a8fd90fd66819df13cd5388ab41829b4cd1fe80a6163099b0e4a7537d4020de42fe91616f2552a340b3e10a18afda9e95c4c0fa7c7765b75683b871ce763fa
SSDEEP 3072:oaL65XilQBYcETmzrxJ2aI2d+vLjjQVfO2ZwJmKq/3RE07wwjFTrQ:obWbcETmJJ5z+jjjQV22ZSxu3pprQ
TLSH
T1FDD31288CB6A86B4BB3C435B20946E07434D0FC9CD5587E96F874B9D1F763BA0586832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7ee.rbf

Path C:\Config.Msi\e58f7ee.rbf
Size 80KB
SHA256 0d216ccc8196b2bdb8c2633257eef40f80918459190b98be069a9737c246cc84
MD5 1fc5afad336ebaf0d613d556fd6de9bc
SHA1 c3afa01fd8cfb54831c43dd6fbdf64f2201156fa
SHA512 c8211b1631aac27ff6783f694323a394b263b0be46e769a1a0c9777c79312ddd65ea94991e383244c6d80c436104edbfd76deff44c214b02131fadaf7dd2a54b
SSDEEP 1536:Zki7xKB14EZIGR0feBCiJIAFXxcTYqE0YuxM40+1zXhgq+d3MX879xf:Zkn4ESlexcTUZ6r7OTd8X8v
TLSH
T11D830237913B92A0D3BBC4F6B4D0D2902D715F73CAA45DECCDC3826CC9A46D825B45AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f7ef.rbs

Path C:\Config.Msi\e58f7ef.rbs
Size 10KB
SHA256 7bf75b5ff2bf50b29980360dfb5404f9a236f3cea31f04a11815ae7d2dac4c83
MD5 c3456d6f259ec7278da5b1cf1367fb67
SHA1 372afa57fdeb773d76eb9562521b4e3fd78a536b
SHA512 08d74277e4ac6a401d13e98ccb31cf327bd3199cda46309ea7767f98092a7415c7206736cd4e78384eea7d48930f690089dd92119cc82934b1cefbeef6bb4386
SSDEEP 192:xrpV2SNbblR3glseKHlFGHlF9kGldjWCiJ2pCw:xrpV2SZfoclYl7oZw
TLSH
T135321F46A21592E2FD931734C303176B3FB3E798A318520B09ED99368F5B3981F6919F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Launcher.exe

Path C:\Program Files\EZFN Launcher\EZFN Launcher.exe
Size 8.3MB
SHA256 a733c515622fe402415ad61df3abc80768fe3e1fb87739bffd07c08d439fd9ee
MD5 95cf8c442bc70aca96b084d92e9b7ea7
SHA1 9b1892061796eb3cd0659e79d5d0012015a04513
SHA512 dc62282ab762a75e829056c024a14377c73beed7b92df22927bf18d1888c2020a919f5043572261fada2d1e4e823cd41ef1a01a5dc9f3e50fb16d26a66a35195
SSDEEP 98304:YhU5OeQFEgxqU6slRX6LyHuwXob3bH62ReMMzU1jLgYOSVjuC27ZhjQNplje0z+4:uez08wXob+2Rz1Qq6ULjDCHY
TLSH
T1A396AE03F69181E9C0ADC478835BA737EB72BC894A25B2AF1BD44B213E26F505F1C759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Launcher.exe

Path C:\Program Files\EZFN Launcher\EZFN Launcher.exe
Size 11.2MB
SHA256 92f9f381140e0d3be9fb2608378b2ef9a4067dd2b1b3ac4358c78f9479dee834
MD5 4902fee7ee561ee983b6a13e741ac954
SHA1 668730cca1889ac498c2ed9719fd4c8b9d8ee727
SHA512 5276c078088d9b7df8a46ae529cfbf50b11eb3d8706a5c9d9c45db10b76a903cd785716cc3064bf1f10d2fdcb19c0a659484ec38cf66e409a38a13c8b9c2d614
SSDEEP 98304:jEyuypPek13/mwDzxhDfzNO7ie8Et21bWeFMU6c3KT4104ssppXNEBRa62ReMnWH:jR/mCDFX8GaM13sepM2RHWG9xBxXEhD
TLSH
T13CC6AE03F69581E8C0ADC0B8835BA637EB32FC894525B25F5BE44B212F26F506F2D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall EZFN Launcher.lnk

Path C:\Program Files\EZFN Launcher\Uninstall EZFN Launcher.lnk
Size 966B
SHA256 38e74fbd5908622c2eaf11705f131b4fb34da62748014253d16ae390709a9d91
MD5 4b2db5a3ffdf4ab53e457c03d2cc1b2a
SHA1 b5ff101bd0abd52d01f7dc4ec8d7b1dfe858a839
SHA512 753b181d7c438a00be9a9610e63ca0d381f0092bf54c524c135d6f79a12c8355907c7d1ed91d5e13ef56aca7b0cfadc1248e12c3ba8029f33b125846f8ad83b2
TLSH
T1DC11B1041FDA0673D1B78D3D88BBD72287B1FC064A134F3F154596C54992601ED59F79
MD5 SHA1 SHA512 TLSH

Submit Download

default_skin.png

Path C:\Program Files\EZFN Launcher\_up_\public\default_skin.png
Size 8KB
SHA256 6fb348720bff52358ef5410fdc50f1b05816fdf69ee46a8c90e644dab7292ae5
MD5 97eb02c682769364d8d31ff17ce9dcd1
SHA1 5ea741681159ad2420ae16059eaf02d5247bfa96
SHA512 fbfdcccbf084456a89f7498af53449238e84016c6812bda763ad6d576891131a6f8efa5ed107de835c07a201f6a501bbdfe6cafac82176d74efe139a0db1d892
SSDEEP 192:Q5IpKm8ISv+avGtQUgEk+lDoHQNP3zW3nMt:Q5IpKmkBOSiPoHQRzp
TLSH
T13802AEF65A44DF38D65EE87B228BC29CE73A43D1B1A53B349DC9CC6942649E91A384C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk
Size 2KB
SHA256 fecbf1de13417f62343e16615f072f845f79b26a82d7f4fc042892741fdb4794
MD5 41c0e3fd03bf23b844000c14c7296590
SHA1 ab633e28a47d89be30ba8198e93e583aa1dad7e7
SHA512 a48b7df01ac78088f1b88fb32d6d76dc672ac5bdd1e076015c928969567efcbae380b7b5fbb0c16f6110ffbc11f5a39f4a5e7c8c41477c8db4b9705c4d1b39b8
TLSH
T118415A101BD9166AE3324B749D70CA229B72BC06A9248F3F4189D2824AB5500DF7AF3A
MD5 SHA1 SHA512 TLSH

Submit Download

EZFN Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk
Size 2KB
SHA256 f17b3b2cb41aab050b29f852bc8fcca119d4fcf9368c407a62207299e17f05bf
MD5 580862882a2212157d7f65493f54b937
SHA1 a782e26ebcb1d27e31a595090e4b3a2c9dbe1f7a
SHA512 03f553baefe7ba4491d7525c6e9a5f941b4d50b8f678c3f1cf0107177e52327465bd5319c5b51af7f2f68114433d865d560de724a1a21e04e6c39cbde9896ed7
TLSH
T12A41CE241BE9166DE3328B7959318A115B73FC16F5388F2F40C5C1824A79400EF3AF3A
MD5 SHA1 SHA512 TLSH

Submit Download

EZFN Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk
Size 1KB
SHA256 0974b335f335eee98d5370ee63ac6a45bbf69a040ad990d4bcb98006de05a6c5
MD5 b87c187438166bf72b4bdbafc55cd6e9
SHA1 d4c29170319eac5b064dfd51a40825856047af25
SHA512 edeef74afc3bcbfd8a1be8ded45de368d651a88a022f3a1f8b82a89c16e2953d49d41625108301db34eaf73077494653c7df49b9e3d4d3fbb5ec14bb2f7b6041
TLSH
T1B5418B241BE9166DE3328B7459318A115B73FD16A9388F2F40C5D1864A75500EF7AF3A
MD5 SHA1 SHA512 TLSH

Submit Download

EZFN Launcher.lnk~RFe58fa3a.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk~RFe58fa3a.TMP
Size 1KB
SHA256 a34466f46c2cfed5f34ea8102b649a78257c6463d414f60c628cdd773919cae3
MD5 31e35cd3a7a211f38ec5e07744e7f8c8
SHA1 7a2157f815f3dcf19c9550cdda9dbcd2d79192ef
SHA512 b2e7e62512a92307c5f3c018cc3e7657d806c3604702fc3f9a04f0bc06a4af58ae8f71e479e8cc2a4256c26ac5a956b0c8783eeb2d6ad6c93ccec7c879f28fd0
TLSH
T15A416B101FD9165AE3724B749DB08A219B73FD06A9244F2F4085D2824A75501DF7AF3E
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b2836f930be706333c5167e94b78cc2f3b8394c7bc6802fa5e2424104bd916d
MD5 28e9ca01af5db5dfc37618bb2db2bfd5
SHA1 618640140201d819dddb17cbe536b5ff570ae766
SHA512 50a6ad0a201f6c08c27603a2136121409bbbd2dcc89fe475eb02e9b43755ee3a396b44a933e039c8e97b79eda6ce31d90c8d4284915118cefc8efda14e3541c4
TLSH
T1CCD0A7B07B65A405E159153355D4C2416395815B29174140B1A0489DB827578A7890CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0dd682e82aa8cd6159af27b9fe9796b85ae32d8c3b7a54ca83c08e7258a7175
MD5 2ed58da04906706bb0da862e8e7185b5
SHA1 3c5218714f1830b95877032ae59a91505796d0f3
SHA512 c1694efeb33c2b30e89769d925a4ac7923301aa37e527971ebc442ad3c0800bfdbcade111c6abe3c94cf362ebe4febbfe65aa0c3ad7f46f25d381ebed28c5a41
TLSH
T197D0806817B17C31E085967015C57B05767DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ce3de864fc029de1185f15a333c36ccc857bab064d704c1c9cb74f2d49559c6
MD5 95e4fa06728773c204126766fa6a3f91
SHA1 b2b2ff6dd17d9d1fca4c1aa1d226d00b195749be
SHA512 11564019829fb23fd1b38faa2fb3c3298ba02394920b54be1169d3ca923ae73304fcdfa9ca88adaeddf4fa314022ecd93085a2ea4ef7973e86e12e5d7e562c19
TLSH
T10ED0806C17B17C31E099967015C57B05656DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 19dfc071e46ba4596d6a7b455cdf4c99bce72f4d3c1e25be47f2235ab0336057
MD5 40a93ebc9f0e5dd6f615d56e2893a156
SHA1 27d99b584f3dd9d9ac9faae72b37f5cb64fc07b8
SHA512 bef757f49e13a42af207d352bc411264b41c90364749e7f0af1d08eac642c38a4182ff7709d4f6128b15c16d13099052950ac65eb31bbf21dfffe8376da8ebeb
TLSH
T1C3D0233437F5F811E0160170494052117B6E855B3C974615F161646CBC37054DFD14C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5ae47298e00a1827ecc8f374e69567dcfa5db7dd7f0bc996f9a96265a903e0a3
MD5 aabf772e118e2744d576defb06b7529b
SHA1 b76e89d0396ae27c3334f1674106000ba20dd1e0
SHA512 00731258960b40baa9bf26a0c6a649f76def748af98a42316f945e9fbb8e7deaa3ef5484a458c2aaec92c57fb2335bbae22fd95e78c2c29c287dbf6221e3f9a8
TLSH
T160D0A7607B757805E04549709C949301776985AB6C5B4211A16018BDAC27444A7851CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bbfca04837831f68c4dc080a6ed82bd3274d59b3726deed8bc4e376c13d8d9fc
MD5 c93c2bd337c36cd0311cdf70088522eb
SHA1 1c9e52268aa9eb62a80906bef782b4685e5044bf
SHA512 822765ea0053b2c36cd439971aafd2774e7e94aadfafd0f3aeddedd72bf6a431ef6e5848bb04d81b81a3dd3a7402c72abc8ae218e021b56a184aeb625a08a062
TLSH
T150D0A7607B757805E04549709C949301776981AB6C5B4215A16018BDBC27454A7851CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b26f1bc9f407d9e91f9c74c9849ca2800b91d267d6187ec0fcde4342670abd0d
MD5 95921f95d01e5b477e8e0e88bd2b3c49
SHA1 9afbe38e9e4882a2fad727743f9944cee8ed9274
SHA512 25e98eca47370acf61b39c3a0a445757afff23730eb9cc78d5dc7b8ec1fe5c43d1e2a98d38c0a486d94f24d21fc07c455dc7f854079f045c860fb5db08260b96
TLSH
T18BE02BAACD219C2709FD0B1DA1504756DE5113472750490F3F3D82494FB167741D5C6C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 29cecfff761b40b27f0079c31f595ce67c62de995a3adb8d6515c145a665311d
MD5 3d96fa8c414288af1b2b7a9b81ac61bf
SHA1 b83ce79d235cc806d285f1388685a9d6aeb1768f
SHA512 3725af3d3c2310b6609115ea2f7c1e5aef6d9afece702f57b9ea82e04f38cce6ca83c412ba8ceba74ab295d446a03d2ffb0b7782567f493a23379ed1e44ba101
SSDEEP 384:BxhNf6Uc9E5W/XpmXeLeGazyPZN0R/iyXEiOrVPGx6ymCzMYx6T+BzTtPadYUZZ:Pf6V9BGeLeGazyPgRfE/JuMLMP2Z
TLSH
T18C13B23E325E9D77CAC6007EAD9B0B3027F4D8A8C5C15A335771786DA39A746391E470
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 74bac3802c7d006057576f811b9355e95aa58133f0805c012552a2c99c5a1a70
MD5 d369daeb1ed1ba68854a682fa20d0ae5
SHA1 1f394c17d4b0fd519951e3b1ae547df9e32ad29e
SHA512 a597e72e0d1ad2c2ad367fd2398d7069ca7fae9d0ccd89ce226337e067e1a417483e0c55764c0089f4c7110bce7bb9333ba9aa9c057b5e8f881d6f40bf492fd7
SSDEEP 1536:3krhTXYBv4Ee0JMQaMJBLJtlADAw/iziod9oS4LzsXZGhIbR:l4P9Wdtd9YU4
TLSH
T1434460F70946A01BCFA802F6D2133B3DD17B015D6CE1FCE9D6380C952965B22B6BDA94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 b581d1e53f05e3aab5263ec7154f52d1487964e4bb472e52469ec4ee13333866
MD5 e49b077f7679b89823a1ab7de0a95329
SHA1 bb9ed50b9cb5c171dcc7d285b1b9865b46b2fa0e
SHA512 bd1c525f1d2375e774899b245fa5073bb094642798732147a3a37ab230aef1f05b16cd3ef417a34187755ba3b7d59bdf7c02f532898763dfc5b8f6955447da46
SSDEEP 3072:Sr5m5fFiHQGuksFUHYyvoaoiSNMzgZqlLqVyrZHGSJPTB:M5od3G7s2YyvoaoiSSzg4luMZHnPTB
TLSH
T13B257DDE8F386D83DEAB8D70F5E0EC267CB421C2B656E0D34808C9A442867C5679B5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 6639902b34d052cb5bf203c62b97bb2bbd9273a88d8f7d8180286305f7e6dc69
MD5 c87b3b2fc3aa80e628921ca9e02dc013
SHA1 fa22b6a3c9da087624a7d15afee09ff33b22c527
SHA512 3ea9293814efa2e0a93a0828b32f0662554fb225a22a9c9dc83fc593718f222af17a18b57c704b443f0b83609a556fbe4f9595bd92d0c62f22e98edf62b43244
SSDEEP 49152:Wa1ynUxoVbkTHEHzc7D4ydUoC4PFuNUjgngb:ly8OkTkE4wPsnU
TLSH
T127867EEEC6785C83CE678A70B4E0EC477CB412C3F555C1D38958C59802A77C5BBAA2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 bbbae11f498dd3b9185963b07fdf1ffcec670fdc329f78334cb0607a667aa27e
MD5 69a9522db3d3711e7d3f28d5f098e991
SHA1 c3b21a990f14df7b27f7073c97264df5cdaa77f5
SHA512 c2f4e1ca1462d32b7b1acb0852aa424cfe3cf3f8953c30657f0963568b0fcaf298e8e5059307eda7a692b30f1f063e08faa508111bccde93daaf2b123f4c49af
SSDEEP 96:3Rk+ru1P3jZZqdcWePLwoN5p+/fCTdVqW1fU/eLkOdj8:BZEPzZEdcRjhpGqTrqOZkOdA
TLSH
T1F5A1836F41B2E279EBE520B451DF964ABAF189D4434F2E3221C258BD1BD2393B1BD431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5e8867d8c75798cac7189af53da6f0ebef4de9f3eed1d54ee72c578f8894627e
MD5 1c92fcac751ed74e9bc8775889dc9690
SHA1 ebb1faae5d4b440f864dc852eb3c94f93427b762
SHA512 723199303b055a4eeb7cf4eace5471bde1939edaa4f868582bcaed81ddfa358acc6ef76f67db56c0decd04c328d0982ca2d2e7eea70221ab3be5d0274d04adf5
TLSH
T11981B54F51B2C079EBE5707062DF9A493AF2CAD8024F2E7222D2583D0BD2393B15C472
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 c3005cabc6dbbd628270aa33bf75bb50b00e52231d5d68ffdda8b7a9cfd19757
MD5 ac05e394a3e77c4ff8180ee6038b897d
SHA1 4d3eb4112c7f5e2e350b4cbdc9631901069cf446
SHA512 aec5c4544a4987bab1e381000e85e35d1e7fc21192792a5c18c75dc1ff51638bf64cdbfb4c6c1057724891dcf37de16014f54249000a2b94de2a0aecb0993584
TLSH
T163E026489BCCCA7EB1947C93827D430896E03487E7E83D0B2749DC45711134AF3AE3A2
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 84199cd89c2bc7ef6fa2817269d6c2156dc774b904b8305051db41d77f87395d
MD5 234ca79028a3d8b8667c598e648d18ff
SHA1 4828e5ecf459e0ed2f19507ccc40021c6593a188
SHA512 4e88bac908e4b1e6b7b8390e143f91c2859ae2ab0bd2be11f0b57293ced48220c32b0e463e713046450fdb549fd077b5702f2b503c8289e7b4f43ebb70279bd0
SSDEEP 48:uzBmw6QU1Pzeufcgp/a/PBTroPrW4BWaLwUgBOjmc:6BCx2i/a/PBCWa8UgBOyc
TLSH
T1BA9293431E793423E7512D7E35AF1836883B925C9FA6AD29317418635DF840180399AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 dfe087e7ec80cbc687afad436446ef40d43e641ca8f884359fb919fb99df906b
MD5 35ca692e4786ea0e7167c8f3d0dde7b4
SHA1 ee83b8a433d6497dd1fcf71bced2114c0fa99cb5
SHA512 a40f147680362d6e8afedcc202e9b6bcfaf1bdf13d5d7f933c06ddb75768a6c028e535677c38d17727005f7bfe8c209e44c54869bed9c462a319f8a0e133f224
SSDEEP 96:nEj4IU+bGz83uy3+u4tgp4DLjGQLBze9z3ojBHMsDEuspU0wbtqrOQpPfR4J+MCT:nQ4f+G83uy3Ct7XBBK8H7DXspU3iV
TLSH
T1AD14211E4F243721CDBD917668E744B35D6DF03FCB1266DA686104B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 514B
SHA256 dcf3ef17ff00a12fed84ab0e8bd3cd5eb5f270dd7c843899baae0f86bb6004b5
MD5 f7f78ecf055936e13f7a1b88eaf5a167
SHA1 91404cdd7caa2751648aab537b4710fed33af717
SHA512 9a268627bed7e694b7d20fb04fd9eb01eb1d2fbe9e1aa7aabba86a74bb3089e245d146f52203bf8ef0aa1f1d98719e6ae562a0dc688190c6d0d50fc5ce48a24a
TLSH
T15AF0E2BB18A2B242F3610EB4629037ACF7A3D30819C493F5CB43D12F2E905F6444A806
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 9f328826894ccf87b1c6f56826c0eda95d2253bdb9ffbf8d5a84818d83132afa
MD5 8338195a7d248eaf7356b98c2e62194e
SHA1 65c03596e34165f8beeea7245195c1c6308b9db3
SHA512 912bf3315db10f7c71f566aa523b9103e6c21e00d0e9a4ee12edb20cf802246e20084469d9a6a8f821e92fd70c7e4541210158eab1eedb64cab9755c8af4ef24
TLSH
T1FFE0686492CDC7AE72043447423D630CD7B03006D6D93E035B04E805B451104E3A66E3
MD5 SHA1 SHA512 TLSH

Submit Download

2dea19a7-02da-41bc-b195-5bb1b980f2a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2dea19a7-02da-41bc-b195-5bb1b980f2a6.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 485ce5a5770455797428f3e4dc0e25ebd0f22d27bb190d1dee47c3b37947b686
MD5 6dd0d61635fd13233d2edd2abda2ed8a
SHA1 1cd4ee71e7dc2f82b04a00ac5e438022a047d1ab
SHA512 50dc68d0c67d255f90b221dba75457d4440fb32a5175a801c64cefeb621874f2e2695b3359fbec1ef680933724d77de3183972ce72c4eb4ae92a7bfe6571911c
SSDEEP 48:T2SLopFMatSaw/auUOt8ByuSryQ2jmuPoNwL1d7Z6nwGC6BI:iSeMatUaAKUry7juO/Z2+
TLSH
T14492724E0F202125C0F54E768DC164B72FBE2459A3676B54FB1420F3CE92A4BB62626E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 3cac1d874f9573386b6b71cc58a404263c9bccc81a102a358f186cdb5413433c
MD5 9037bdf88c7208c25da0e3315b86a9da
SHA1 63d71c25ceb807114b7dfec6bec9454ce4c52e2b
SHA512 90eaac1bd81e2c162be9872c5eb1dccaf4d4e52f6af4f9c580ed92170d3291f3167c5768064d7d46f7f88dab6db231502203a9bdd26d8af7f65c6b56e2279222
SSDEEP 192:D1wwaDFhGgJ/bjJHJNeqRBEGI0uGqj6kgd2PlElqb7yh3z4U6zPasEu2ZPbTE9qO:D1wwaDFhGs/bjJpNeqRBEGI0uGqGkgde
TLSH
T1DB129FF7C3E4866ED91152F1AB183E2BDF6E1995432C3D0A86D49F0BB3E1470E24295E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3b4f00558f9c48bc953aa16d6f6324cfcab35df91239f4036be7a6c88c19aff0
MD5 eee49e5effe7e6222f642c36a92675f4
SHA1 1aacb52ef1eaa2e6b86533c74b5590002c6e60df
SHA512 fb7783368cf3ff6331109cd6332ba5784caa467f6431c733569da59578c83dab7a81546ac7caf4418630ccb158bc33cecd370e7a7203a2e710eb745187c52040
SSDEEP 96:D1OONtFaa5zS40IwB0deYbGEvSYqGwe3j6xQx4:D19nFaa5240Ik0deUGEvSYqGr3j6xq4
TLSH
T162A19CF7C3E4866EA91152F1AB1C2F2BDF2D0995432C3D1AC6E49F1BA3E2470E14195E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 2e6cdb6b76d0bd9ca46205f9f0b351a3a649a17c9646ec5fbfa6b9aea46f29ca
MD5 b2d23d47be2bb97d5e969a880fc4960a
SHA1 674eecc4da7565176d58426ab1f4ca1bb6739925
SHA512 146721431e96367057fe9be24482b9f33576f0f5336afbede4350981ad0ed992b6bb2f2210053e6fd9ddc0b70117cd12189fee10d09a955ad206bd9bc54e8e07
SSDEEP 96:uIEumQv8m1ccnvShf4kBiWuWTHnpXfapbnFXt9Zn/I4g:uIEumQv8m1ccnvShfVznwTJS
TLSH
T1C5F211FB06235205D94444F0A4446FCFAF17404743B6B2ED76C447E3F2A20E2B5B979A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 394e08be9b6a8658d3b7752b317ada2fd188a8463ca606a4948849ff1c38928a
MD5 4ea8b9038800e60e1e4545bc35582906
SHA1 e9cbb7e6b3ed2876d18292e68dece6f3096f3914
SHA512 d1974a8560b852cdf7ff7dd252b64e55588b7962228825e53a4727e7c9321c3db88e1835b70b3747ed5b411afade010d92bf9af0fb888bba107af2086e863770
TLSH
T11AF059A3C57EF827202C48372A08B802A5B65130429368F9DFE2807CF0C05E71B1B422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 fb45abbc2164f1dcd45f031cd331231f4368ba5ab0ecdf83dcc7f64a1ba839a1
MD5 8a47c91de8042118c4ccb049d4c46c87
SHA1 87871164d99c278ded1b5352fa394a5740000786
SHA512 247d58d425b8250375e45a485f9f07344a27d76173eec5ac8eb2194687e0bde8866c25f5799704262b8152a6a36c3b5edc0108803597c04cb58786fd5cf4edb4
SSDEEP 384:sxZoAA5/fqs+WvtK4VvC41EHbppLfKZWze5A+Zf:sAj5/fkYtZUHbppDKsze5A8
TLSH
T12C82E916A938597B8DDBD61DF641BB63D7F9152392904E44AAFCCA1C00D7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 12d1ca466aaa787305855890841abdabfd522f62717c7ef7a6979f30b135246f
MD5 75f4ce91fc85f6daf5ebda9ea086e52c
SHA1 916dc8c31c856ab32988c0e67808ff530cb39720
SHA512 74afa1c6621d0ca537409946eb61b2b1d18e016a5b98d82256591b8e72ca78aebda85ef2f284251a52a49eca0ab298ea7c39b81a956d282476cd27e99dbc212c
SSDEEP 384:sxZofA5/fqsOWvtrH4nC4wlHbv/O8IPZf:sAI5/fIYtrYWHbXfId
TLSH
T12872E816A938597B8CDAD61DFA45BB63D7F9053792904E449AFCCB1C00E7AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 cad3cfe3921398e78d06820ed7d138f985acb2518c6832a8e48ec019de1dc886
MD5 deb067b7f03110f49fe45d100312f31b
SHA1 30d228cf036530ccebaf92e82b4d7b1f4f7ef02b
SHA512 0fa63e004ca4d2ccdb590474f5729264e373110f440c5a6189a38d20b3b2f7213c19731892c0eb161d3346e3bc0bf40b1f566bcc54e96de7ce142788dc6797de
SSDEEP 384:sxZoXA5/fqs+WvtOVvC41EHbppLf98qZWze3A+N3:sAw5/fkYtOUHbppD9lsze3Ac
TLSH
T11E82E91AA9385D7B8DDBD619F645BB63D7F8152392904E849AFC8A1C00D7BED320381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 dd3e1fae124d34d098b0bd6879cfd37f705ba809368d1571c66f42f8ea3a988e
MD5 b384793c2acac7b30905eed9ec62cc24
SHA1 69f2921bc1ad544c20b38a95b8ede6124038eb94
SHA512 a28e184082df44a6ddb4a7541bd5cb45e994c5bc64f8c8588feea08bf5ce86b6002165d073234256a306fcd455744ebf183b0b031cc49ca3d99cb748fb17cf23
SSDEEP 768:z0sjWCv7pLuL/OmWvOKPC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8j+xLlx72BUro9:z0sjWCpE/OmWvOKPCu1jaVj+xLjyB/KC
TLSH
T1B7F2FA3B680CCB7F4F805E9CDC2A7E8E6DE8018B9698895447FA884C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 132fd26fbdcba40cf226b5d7561827638df8e51f54fef05e7cf91801cdae2860
MD5 82ecc1b90a9064086fb41a5274671878
SHA1 afe5f0972bd92b7733c005b80384e7cfee570710
SHA512 399233330afc76f5453c49e31d6396fc083178bd41497ef212efdbaeca927654b03fd29ac673abcaef176ebcbfce76cf3a57c67cd81b3b4b94f564acf17a79f9
SSDEEP 768:zjsjWCv7pLuL/OmWvOKPC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8j+xLlx72BUroc:zjsjWCpE/OmWvOKPCu1jaVj+xLjyB/Kr
TLSH
T157F2093B280CCB7F4F844E9CDC2A7E8E6DE8018B9698895447FA884C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 c2b3094faae7393e15cbe4c9c8ef4b8ef272325b064ff8c8b95966e27385ebff
MD5 fba14704e5bf7c3fdd432e8b067c1dea
SHA1 5a02809fac2af4fd4d0cdc218200d0a3301bd22f
SHA512 da8a081a28da9792ff8e23e46a8074d68093c72fb4d241d07b70660baf2323a146647c137b10ad35ef31ad88418674da6b2a1008e7725cf71518450d64f68313
TLSH
T15BE026585BCCCAFE71557443027D8308A2F4745BD3E83E072F80EC447152A05F2A62A2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 7f7dc6e1fcfc6db1423262fa54c02dd53ea5cbc7722829a70af822716318687e
MD5 d0b69663c2b525375899baab6f3d953a
SHA1 6da5ed8e812ac16d92167a8c450f4fad2071fc97
SHA512 0e19b7e661ab7b75522b584d69ebb57f480e2b1b12d0effacf4e7b8db4b59462a9e3ce4521c5390d428fe9cd525ae6d6f78dd3355e0cd36ba3efb9e0ea9346f2
TLSH
T1ADB092663B00AA15C1C40A722181CB42A331F10110488886490A9F9109862AA3E009A6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 595ab537a08a7f07d83ff90742c403aa46c3471027364ea4f13d119dc015d844
MD5 632c853be9269e4d2d32acea34106d84
SHA1 b2f1138ad40ac628b7681eb036d3a07ab00a379a
SHA512 2246c7841052e2a8093d07e035062ba050e3873896fb5c17479b0c1f91bebd54647ef80efd0d44263bba78e6bc525764b8bb5f4f0e517b695913f4d6043f211c
TLSH
T1EBE0D8A467CDCBBFB1857597427FD30C91F27446D6E82D132B08F8447246640B3672A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 b99f94029ff4d2c5b41a46a28f730cdfbcb3eddcd74d0dfbab1173a24b99ac97
MD5 9a8867f46f6a3b3b306afcafe98bb197
SHA1 4550cf0263c8f352079d5937f1569052eb11b4a2
SHA512 94ffbf050cf12a4778c42f01a13eca78ddbb8e44c3f6a9e5a101610e7224112cd11eead568df71639e1381acf89ee23a0a91e8788ac88b534ad90b51fcacb5e7
TLSH
T1BBE020B89FCDCB796041B4C3427CF70D93F0784693D43E035B08A8447101601F37A2A1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f57469bb20fee9aa9730d7d3a22af8285efc0ff7827b124d61bca3b55853c371
MD5 4ef0391c85a27b02694023de35a0e6f3
SHA1 107ec09b8b378ea23e7411394bdbb6350c70ebf4
SHA512 6350d3776d886e0af9ceefdfebb803aa41435afdf172c7b5592b28e0f3c9bc0ba036d4b7bb3ac4ad7a17d95bc4fcbb906cd1d8eb96c8d0781bfbb8e2417b8056
SSDEEP 192:0BKLfyFpHbxpBJhZf4f7Kn3TTmPj1JF8BwP7n17dEL7g9ztPX:0YzynHlp7hB4zK387X
TLSH
T19DB23711313A42913A7EB9CA81E5B42E52C334B77019E42B7BB944A64F67E20DDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 6ed02e6cf33329191db1dd1ec534fc7cf5f216ba9e8fe197a01296680427c326
MD5 cb2f7f02debe1fbba775b9316790e13c
SHA1 e3eb8b4fd69757e7afbddacdebd7cee395c027a1
SHA512 2c50a313f5f9128349499c50623af33d5f2f8d6bac159e1b15052ec53c22b98e17b38c25c59fb5bd50bade6ab77bdb3627ac5a8d598ce14277e5a795fe34b795
SSDEEP 192:P+xWXwKfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxIpfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T15424740A7B747001EDE6D9725CB080771E3CB16DCF22A6916DB254698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 4a8371977d494f5761685d4b7023f40015ae2b7b93308909e2f364846223e653
MD5 e8bf509af65605f6721654cc4f756dfd
SHA1 b91a813283dac7f141d32bc8efff129df880e07e
SHA512 1d358afb5bb97cc898789021cb77de23a0025cdfac81753aa056590b8f11a720f720fb53542f8a6eb665915f51cf4addba1850fb61fc2b8e33caaf184f7dfbbb
SSDEEP 96:n89+A4QDVgxZdwlQgOXhSZeDWXWY1lD51seC/hAWVPclrz+QHWWVPjG3f/fzwl5N:u4QZwqOxk7YhAsPclrz+Q2sPjGPH0l
TLSH
T1E8221D646F021F33D61D4EB316798B6213D3C48242B626AFB561186C1EF2B67CBC82F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 c2c02503b433de7cc798c92110f05bdb69b04cee9f2f41eb4196e7248f6628b1
MD5 9192dcaae78e26926fd4ada3d2e3acef
SHA1 1e5e037662444ad61ec4b807cebc5d6179edb526
SHA512 89d1e6834b6edbb8fab3d40398daa218679221eaf74660544c3e2ca910db50684aa5a685999dfa8d184487ee47e13a02f04a2f41a49e6c4d4391646f88d30bb9
TLSH
T152E0D854EFC8C6BEB155348B213D4708A2903843EBE42D0A1B04C4497001201F35D362
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 a6239a1e8023326abc47ed7956176461429d4c21fdf55d416107f51337c203d9
MD5 661960ee4a1b17addad3bd5810d45303
SHA1 20828b346af539abf0922accfa830d57b324fa26
SHA512 420be3818a0b5df53a31a8683e9ed0f3ff697b9fe75a42264f37931abfb1567f45369c6d7d79d18417c1e889957ea0f03e946a3cddeb4680d7e3a769a98265d9
TLSH
T1E0217016F320C158E28E867D902B97351338E8178FFCEC1F417964762DB6E511E8BAE5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 13b654294d7024bf615f3531c468945683c11ccb5762dfb59921b5b09f356e04
MD5 9f4c9a59f538b7e5038b6576ec4a0b0c
SHA1 73d41e6ea87204c838d3a5750fa6a67c0b0f9409
SHA512 841c67c4e44a65b6a2a779bbcb81fec993f78e5c2108552dcc81cabfab51efe004d228544054c8d6590c08cf34302775ca7a4bad87143513fb5ef427ad39bd8e
TLSH
T12CE0D814FFCCC6EF60557587017D874CA6A13843EBE42E061F00C8486242242F35A362
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 b42806be68b4f04d930d63682ddaf249713fbb7bfc4a5777ca035527e0021c92
MD5 f34058be1d47b00ff369f12e3d8c473d
SHA1 732c3b227a840c33f81d2316d5a081533b3c329e
SHA512 11f26bf334a77c17487d8b20267eed6f52459059294aa134eb6767f1cc77b75fddb6e7998e16f936ebae70e691fd0de6e039f12c2fe264c9717ed06daecd4431
SSDEEP 3:MsEllllkEthXllkl2zEflVMNK:/M/xT02z0MNK
TLSH
T10844040C7FCC4455C54030304073C7501771D4104511574374F1043FDCC75C31C04010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 50796df91203d91c6dbb918f954a536dc957507c73b87591b9243a50edc42012
MD5 e51de2c71bebe3ea1e49ad6e24501697
SHA1 74fe56bbc064b7c4130e41cbf3690c89da168caf
SHA512 9c87e5561785a34351392027da23668b329a5ff7c8f75c2b254301a9a035e5f1e7a98d462a3bb8f6fa913718c1519877f2d3b8dbd4f3332efe8d1b7370807afa
SSDEEP 384:np8iFavqMg3sN58TUNTUlImkrbPNmYcl4fFYaCw8b5iWRYV/Vw1mRyZF/0rN1k+f:pnFayv3KwghvYaDWRYk1mIZF/Axv
TLSH
T16DC24B36E894CE6BEDE68FDAF7493A07DEE04167DA8C4AD4D6D81E0D00D709E530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 897f64b2c31149ff3aedaf5cd7b9e33533c1a70574ce8f89202032eaffda6fd1
MD5 4f9697cb6776012cbbfabf33e3a7bee4
SHA1 2a9eecd09e8471ee9aaca08227303949af3932a5
SHA512 34837a59eb7cc11c7ed4ffb65ee1ef9a578dce78b5a6ee1ace504f583d98baf090e6f653d7fc248b8d3b3e0acf4f14e047eb4b39a384f9a42ccf534092226717
SSDEEP 384:n28iFpMvqMMsNO8TUNTUlI4kvbPN0/Aaul4fFYaCw8b5hXkn/JkPG9jk9SSBFC+s:2nFpMyxlwglsYaQknCPG9gSS6SA
TLSH
T132E23939DC54CD7FA8EEBB89A34C26129DE40177D5A889D8E7D80F0D90B208DF74B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 14097303f67850a92c6868c3e9164138e17f74962f87e4978c90016f85a199df
MD5 0cfa44a5b29a78f627c0f826892937d3
SHA1 b19712ec2b2dfa2a17efcfe5b0889ac16a05807a
SHA512 a8c1d1fb8293da2d9b9e27a954ae02992624d61fc9ef6e3b3ab1ec7ba02e7b1d245da7a5b664f4d9b5e5dcc85ee31d48e07ac64aece4be675ab09ad0245fcb32
SSDEEP 384:n28iFpHjccCs+Bt0S3IsNEZ8TUNTUlI4kgbPN0laul4fFYaCw8b5hXM1SBFC+aj5:2nFpDccQonZwgvsYaQM1S6U0
TLSH
T1B4C24B32E894CE77EDE78F9AA3597743DEE001A7968C5ED4DAD84E1C00871DE130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a58f3c49f5affd9bdaeb81a66d2347a1d90c512172ea7147713abf7144646424
MD5 ce28a91fd1e551fd18dd3ee8b256ddd5
SHA1 83d27f2f43775f84ba5f95e3e153a0c5b9bacbc1
SHA512 0285dc43d8236ff0691ed078ca4826d5e4ab8f6bb3513389c9e5a79e4104696de883cc7cacaa3453d5aab7a50c4d7063a13f544e45180fe82cf59bb124fc0175
SSDEEP 384:n78iFejccCs+Bt0S3+sNEZ8TUNTUlI4kubPNcSaul4fFYaCw8b5hXS1SBFC+aj/x:7nFIccQenZwgisYaQS1S6U0
TLSH
T14EC24B32E8A4CE77EDF74F9AA3593603EEE00167968C5ED4D9D94E1C00871DE130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9cbe5b24fc09a50376f13a40ceeeb5db822d1e6d56cfcf6eceb353bea963ed5b
MD5 e0fbfb6a3539ae0f9123982ca8b36e04
SHA1 d828f5b4c55b466f21830201ba8800473230faf0
SHA512 9dce93d7ba8b1a2638a0927b2074f520a5bc15ce22adf07e43f91ebd1475a63a510747b5ee1fca0214e60ed98273b8605428f1bf20ec4101a394f003194629e1
SSDEEP 384:nL8iFejccCs+Bt0S3+sNEZ8TUNTUlI4kubPNcSaul4fFYaCw8b5hXS1SBFC+aj/x:LnFIccQenZwgisYaQS1S6U0
TLSH
T185C24B32E8A4CE77EDF74F9AA3593603EEE00167968C5ED4D9D95E1C00871DE130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 aac245d885e401d567ed7149c074093b901dac878b99282b8977b1ebd904f661
MD5 c0464742bbe49d44cd171d164465bc8e
SHA1 5f15e59405f497adaf39e32a4ec9cdd201918bd8
SHA512 95d927d45baebf3184686e1b7ad047a08388a484b606c77d6b84bba5b6ae1771ec7a8bc2e5a875c687058c0f52d23e45cabd5ca957d43f57597b40fb147c043c
SSDEEP 384:n28iFpMvqMMsNO8TUNTUlI4kvbPN0kAaul4fFYaCw8b5hXkn/JkPG9jk9SSBFC+s:2nFpMyxlwgGsYaQknCPG9gSS6SA
TLSH
T19AE23939DC54CD7FA8EEBB89A34C26129DE40177D5A889D8E7D80F0D90B208DF74B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3bc7c81776fd87f8dac36f52723bdfd37c19360c3a7ec057d3e2518048828c36
MD5 0333e912cdf68459af93d2afd51672b0
SHA1 2b14645bf94121469ab843d5e92e7e3d35bb76eb
SHA512 e0025db8c4f0a80d8646ca704038885f9f5e05ffc02de677e56b6c7f0f433f225af0c21e7630d52f2c7cf3974f12cefa30d332cdf75251bf527a09a8d258b2a0
SSDEEP 384:nJ8iFavqMg3sNy8TUNTUlImkrbPNwjMl4fFYaCw8b5hXChRYV/Vw1mRyZF/0rN1Z:JnFayv31wg2fYaQChRYk1mIZF/Axv
TLSH
T19DC24B35E864DEA7EDE68FDAF74A7A03DEE011A7D58C4ED4DAD81D0D008719E130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e5a11f1d41f2d00eeb9e7993e646dbafa04daf67fa1c2d85cb21fcd9dcc683da
MD5 31527c1ad6e79ef8c1f2aa2f499871c9
SHA1 9c240404bc333c5756c136d8aeba4265119d9f17
SHA512 471231f94ce9c82785764f070a082ff7063ed939588225f0fcea970c7610123cbebdc2292d588025a2c6166ed718ef12d894d7730f60294dfe06e01c2c994a9e
SSDEEP 384:n7/iFejccCs+Bt0S3rqsNEZ8TUNTUlI4kubPNcIaulZfFYaCw8b5hXB1SBFC+aj5:7KFIccQOnZwgYlYaQB1S6U0
TLSH
T1E7E292F198D78977E8AE4B97A37D2E029ABCC157B5485994FBD44D0CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 43c0fbe568e6c799c67c6c270a13eae70cb15b2efa0cbbed43be0f37cd5afd06
MD5 cba3df77870783cd53c7321958ab0e7d
SHA1 89a3e8101c3dc3d1076274489c93fac4ffdaaa28
SHA512 345bb364103627dbab9bfd1cf47df4ea7bbb46d28f15acf025485f1ad0b76edc08cd3f19dd188e7d4c046cea705fac5ae0d99cfebb5ddd818b3ed912ec9d11d5
SSDEEP 3:MsEllllkEthXllkl2zEflFM+:/M/xT02zoM+
TLSH
T17A44044C7FCC0415C5C010304073CF541770D410451157C335D1043FDCC75411C0C050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a8a77b8212fc9eb9a7a79f0e1f41c98107918d9dbe7adfacc3bb6e5aff920db9
MD5 e6d720fc8dff531b78f6322db1c69447
SHA1 027e8a39a44155b5dbb7706aabaa308616231313
SHA512 788ae4aae5c56c65f98b9f1ea9216f3108809e012e8756c2059db04fdd8c8fd9d1a23e0c0e52a1285f9da0f330e26bac6042aa2fe3effbae67d273cd67f0032d
TLSH
T14F4151E04C3E2AD1D4BD0A3E748B78FCD5DCCB2AF5A4347D6824DA880A3A50D248543F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e66d638abf954c9e39ac52b6e6cdba17cf9d94a6caa31dca085abfda7026cf4e
MD5 1d6258b97ba3a4b28b6ea422a9866552
SHA1 bc29e12672e51e828298b34a4d9b19596453c2cf
SHA512 b3884af41988485cb911ea23c1e99b395b9133e16926996d44ee4244f1a764a7e2fa925a6792334440a6d8f0981ad2a4f53d88fc3e2868992fd4701385e1139d
TLSH
T1E041F858BAEA1118B3B77E56ABF7A46E847B7C772E46D55D00110D4F0A62B40CC71733
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 797b142016071ba4e4c08687deeae82ee2a38ac1a3f63f7b778acdc4c1be2a56
MD5 960fd8f31740d40fe57d68199e95b73a
SHA1 d9da6e49d0c9781b1649a583df4cfda70cd053a1
SHA512 d7dbc124505cbd8404a0620f3c32f773124a364626d2fd0f67c6e6ea6a329d8f117b780f5ef59bd308e211398c36e24e53998d4dab2c1ea485668dac4df1cfa2
TLSH
T13E410958BAF91148B3777E569FF6A86E487BB9771E06D49E10010E4F0A63B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 3eb146b513a33ebbbe6b10cd63be6e7146df8336deff2f5d348949162f25ea2f
MD5 f646694c875dd15481e9ea1cb78df3c3
SHA1 b88640fbe16bc8ce8a4ec9928e3271869e40e7f3
SHA512 cf7c599268c90e01db6a836958a8aaee8e5ed53fa2b68ce496bcd650326d7ce565526e806ab04e1175555034ffcc0c971aaff3c51f7aa363f9a9817eb7d28050
TLSH
T1CD514CA8AAFE1148B3B77F579FF6A46E447FB8672E16D15E00110E4F0622A41C862737
MD5 SHA1 SHA512 TLSH

Submit Download

3cfc2b02-3597-43f5-8438-9bfb7a2188be.tmp

Path C:\Users\Admin\AppData\Local\Temp\3cfc2b02-3597-43f5-8438-9bfb7a2188be.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

MSI17F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI17F4.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5474.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5474.tmp
Size 113KB
SHA256 aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
MD5 4fdd16752561cf585fed1506914d73e0
SHA1 f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA512 3695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
SSDEEP 1536:YImZwomOndvrhsgz56GoiFmntw1ebC0fsWk0FlcdOJKJpPpxyNokVbY4:jewOdvregz5L/mxb7FUOsrPpxyN7/
TLSH
T19EB37C1275D0C072E8BE0E3D45748A715F7E7930EF648AEB635812694FB42C0AE39E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hjka2zuf.z5c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hjka2zuf.z5c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e4fd056e5ee1c0d5cfc5d6d546ac65f858aba03e89ee2c7d6a1c0c910e66bd6e
MD5 8e4cfe64574c479bd4a83c6b440a0cc2
SHA1 a66e25af8c0e2d7d4e48e02dc2df2d7fe5ef324e
SHA512 6e7c4379dbefb29467c676e15b76ede5f6f6736240b84f15df68d50c25a0fe070ba2dbaa8fff0f3353d8339e01ab7ffcf62bcf62eb6e4bd351bb53c5ac4d3657
TLSH
T1BAD0121632530174C1603073004261185802C10BC10540C0643CC51E3B480501A36441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 422501bbb452a8aea1445287e309186d4227ae823c1ce01d7519cbc0c4f121f6
MD5 38f5537ec9cb66eed57a19a0564a22d5
SHA1 0b80684e75f795bb749bd023ba361deaec71d4e9
SHA512 9829d58d3fd5ed996afcca3d83adc4c8a806177a51b5596297a5a1ab4a1a5a5184e3cf1407917526f293d2be6972af66d7b1cc847fe6bddb6234e95c4f991754
TLSH
T105D0C02B31334E20C4F03D770082D1163E65800AC483A1821C1A910F2EB41C21FF2344
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4e9a6b4736910afaf1c0f67938eed6bffe773695c3535a96594c2a08627e5904
MD5 93aa3b1faad501180706f2d7ac441d0a
SHA1 a8dd8762f029ba771efd865f43c454de62bb379d
SHA512 d50188370f0c6d8312eb9b634b3bc83159829882f636f13e85d94e8bebac239c5279a4f57fe883b9c187f514afb12173b35e3c4bbd6e021efdc6ef7f8ab5a2bd
TLSH
T18DD0C02B31335A20C4F03E770041D1163F658009C483A2821C1A811F2EB51C21FF2344
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 eb3be440872fcb20415917b420743d3291d374fbbe1ecd70b1912196f8ac00f2
MD5 dc9956945006d8620d3f3dd0c13faa12
SHA1 da911464d7b5a3dc608d36b3d3a4139a54dbb871
SHA512 275738968a851989c190175383e6abcd83b2a9a9ba0ecc14ba96de27e0ff7a06ccb996c5f6ff58980c36c0716f1b6d5c8c1dddb8c8e69377329988755cf9e2d7
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 d3a7902373039e1087eac464ccd14dc8cc1a75d81967155010c9ab195d89b1e4
MD5 4b59c12328b6dc0ac77431ace4803e90
SHA1 6fce5803bcacc3b9f9ed00ad96b2c429d51f6d52
SHA512 7684c2f43561e2e1ff65eb7fa4f985e48abc63fe85bea343c89b331481491594cbb78dce07ed19044d3a5e129ad51daab8fccc60f2c7704f146568324a6bb394
TLSH
T11111A99B20D1E5C2FF6964F983D40E8EA571CA682B071B7341E6CD7949872E4F52D201
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5457b44e0e25a5bbf99935eeaa07b708d2bc70b844e86adae5022151502fb30a
MD5 3abf479649aed8e3af9791a61df0b203
SHA1 7286653f4959366617839892ecde5b56dd485d78
SHA512 14c4b190ad9cc8c53aa0b77255b81276c21c59ef9d9d51736314a153c7d728ff165e5c35e5497339adc4395cc1946e88ff1cbd407b18f8138e1684f6ecc29312
TLSH
T14C41E79720D2F8BAEF1895B0A28C0D8D65758A585B021BE3E0D6CF380C7F5D4EA3D171
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595f0e.TMP

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe595f0e.TMP
Size 48B
SHA256 2e4a8186187144d722fd6eec1d87c0a6aa0c4fed7c13761c371793dcee031a7a
MD5 fdc51b268c8febaddb46e44f2e1facc6
SHA1 88331938eb0c58b67c4d1df03efb6b558515be73
SHA512 4220c1f0869188ef4c1bc3554d9d9483665df09ab9d8f1cadeb2c9ec7d47e74ac33c4f1aa78e523755e36ea9741a6b81b885d0933d1ebf5fe4ffd561d2306a33
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Network Persistent State
Size 601B
SHA256 4e25ccd1158d7f03d35cecfc30bbfa371ee7fa68621d535f4b13abc3ee383b37
MD5 c305b685436a02d94df92dfaeb0c97ef
SHA1 4eef28c892ea81ad40a337c84a61ccb475743445
SHA512 fea72573dfbd27f6aa1e6b9f882c4f9bd22a5ee9f6e5b832801c40a5061577823d740b3471c36b9d4d8e70323be41c61badba669eaac2e56e19b7b3cbe887678
TLSH
T164F0E1F2D6E481BE895716F86A60381FCA1E080846BC3C19C7E5EF974FD2539C11610F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe595f3d.TMP

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Network Persistent State~RFe595f3d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 1fe158923759a5d47b1d2a9d897380ff693f0a9422e6415568663a19995816cf
MD5 c27811295db35fc724a566b09ec76599
SHA1 f13f9b1e75633ca500cb3ff32f83ae8958f96b2e
SHA512 b9338a3a53b4cf7ddb62a7e1854dbffec1ea0128dee5b8b8eabc984ad6f230041d217521b55537ac411d28386745fe6c5cbd4d4acb4190f7af5efb0d70b55008
TLSH
T190C022E2803AF43A303809A32880AD42EE76A130008360EA865249AA70401A66207422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Preferences
Size 6KB
SHA256 03dada131d57b6902866d983b4fe4277d45d7763633ef93de82ae138c34ffaa6
MD5 ac78a98fb6077bf9b5bba5450ee6650f
SHA1 c4669623008af335b7a31ce24fcfa20c2a2de2f5
SHA512 39fe5d8b6ceaaa8bc391d35dd1d586cdd4ed3c860a4441ff93e21812d94abd49b8bacf79e09b5fdb9598cf43445310c880d989f42688bc41a08b3d8a1d630c3d
SSDEEP 192:st90UbnK6fmZ8pakz/S+Wi7fIodIGZTK8:stmQnK6Zt/VUore8
TLSH
T18CE1B847AE28A97B4CC7E61E7A35BB02E2F5107266C41E58EFFC861C04E66CD120790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Preferences
Size 6KB
SHA256 9c2aa76daf29d5b422fd7116ecda244cfbe25b34f1751bf8051ebb1a10d136a7
MD5 a10370b886a74a56adc466864956d02a
SHA1 b87d003399e2846070bd79cecef213037f339e4b
SHA512 eb099a25fe225cf1a58d5a5df6d7c98d5eb05e008f60f5df870e3abae1eaa397bf8b78b7cc1e40f0f95e8d583c3f064ec438209308cde3451149f89006b20e4a
SSDEEP 96:st905i++CfkwbDljffq7Z8i0vhEjkUUm/7qx+WVHMSm+uecp8oEZdQjZ+gDOqZSx:st90Ub8fmZ8pap9/S+Wi78oWdIJjZSM8
TLSH
T162E1B9479E28A93B4CCBE61E7E35BB42D2F6102266D51E58EFFC861C04D66CD130750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Preferences
Size 7KB
SHA256 33e45a4482c0f0e9331166932b85d05c0a8a57029a79b8b9eabf6b830df8f0ee
MD5 69642172bd133805354a8d6cf277f819
SHA1 42468c642b0057bcce28b5cf8daf3493ab631b26
SHA512 4922fefc8f1f90f31a552db8d574fbe9d151f201a00c001d25b5e73488969b86c570e8e38e6c9b7a954d71a0d9bffe30d6dcddde0b53a1310e74285afdcc9f39
SSDEEP 96:st905i++CfkwbDejffq7Z8i0vhEjkUUm/7qx+WVHMSm+uecp8oEZdQjZ+gYmZSMC:st90Ub1fmZ8pap9/S+Wi78oWdIRZSMC
TLSH
T15DE1B9476E28697B4CCBE61E7A36BB52E2F5102266C10E58EFFC861C05E66CD130750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Preferences
Size 6KB
SHA256 02b6e52569eba58dc65ee3c85dacc9f0ffe53b7389f78368760a546382ac5b96
MD5 606b865a3f56e4dbc96b2d424f6c0fc4
SHA1 7112d8083a4975235a974bb19ed58d934efdc062
SHA512 3c7c2948075449c31f1ec2cc8781587867800dcf7e429d47d89755842391687390dc4475c0ae662261807582e592dc8029f313098dee20f9fec8f26caece17d7
SSDEEP 192:st90UbnK6fpZ8pakz/S+Wi7WTwdIEZ+M8:stmQnK6kt/VQwPv8
TLSH
T1F2D1A847AE28697B4CC7E61E7A35BB42E2F5107166D50E98EBFC8A1C04E66CD130790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 1KB
SHA256 aab2fdf08ea5e1afa1f97c215fb0491fe019e36fe85b66c86db81486673cf2b6
MD5 126a74a6a0df53ccb66b3de68954d0ca
SHA1 745737d3541f8828192a72e59e19e3b2f5f9521f
SHA512 433ff8aaca73af9c03e1e98d398439bea8fa7871888095b88778cd7c40a75eea6ce1679502697dd5ba5e69d474a3f4f2046c9951b8eaa29cc630adfe6fded581
TLSH
T141316273F4102E365986964AB2913A476F301036C3514E4CE6ED8F2C15D76CE522AC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 2KB
SHA256 d3d930382ade99fbdfd9158717021d7716ab42aee8ec276f4a19a0b2a115a3bc
MD5 f259302308f3f274b749719eee8483eb
SHA1 02c21ff3207a013f877fd0a650af3ee7b3c442bd
SHA512 7230bf09eb4340136ba9658e4e26f39c61593a771b924a0340fa077a6e767828326440a1c970a45282ab2b2dc4c93ea51a476d1642ca12071cb7b77ad6e8542d
TLSH
T19451A733B8146A3B49E78A49B6453F12AF345172D7522F54DAED0F1C01DB79D1306C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 3KB
SHA256 50031acd3fe02176c0bbf92598df1efad9c174765f798fd85b75809fc860cb71
MD5 9d02183bef2c082d04addc4981a1ef74
SHA1 062df2eb1e88061787a034dd9fdefed7dbd93975
SHA512 533c90c7587389be77fbf5b59e7d0908b41cdcd9344320899dcc6e0e800d0408890426cf00c04f12f6938ccddc26e710329810456e66d6c13ab737c8d4c15f94
TLSH
T18D719427B824A92B4DE79A05B9853B06BBB15137D6D63F98DAEC0F1C01DB3D91342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 16KB
SHA256 4cb78fee5d089b9154d8eeb8c4a154f7a7bb1d8037bab0fd9d5e3db92b1efb3b
MD5 d25cb7564c1ebf9f0ccf6ec6558d5b27
SHA1 3377ac11b01145a1813ec75e1fe34085eeec50a6
SHA512 61b8c637cd20e2ae1194f814b991fd76e3f48ba8754da3bcf6dfe89f10866223fe42f107d51608f61da9e40613a05ed404e6daa92af2d8cb33c9c63ce54e3ced
SSDEEP 384:zifRE5BdEZfr0kuh9Rt/nP9yf3NbKeFisqpuNQl:2RkurqhNsfNMkQl
TLSH
T1DD729E635931AC2B5CEB850B39056F06AAB4805A97D72E98BCDD5F1C0AC7BD61353C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 16KB
SHA256 56519e2ec37343ee80ff922f34a4e3e42cbe81f465c7db58cff6f9c2b12f6e1f
MD5 1e16852ecf7a7e3e2c5aac08fe2880ee
SHA1 05eabed0aa023922fd988a579b463b173debe5f4
SHA512 af81b478077a9846e06597e9dc9c03c26a9ce24235ceea9734ee29072b93eeb77bbe84efb06cc9e55f78580bae40880593c29823de5ed91ecc5819cf0b7be8cb
SSDEEP 384:z2fRE5BdEZfr0kuh9Rt/nP9y1NbKsaisqtuNQl:CRkurqhNsKMAQl
TLSH
T1EF72AF635D31AC2B5CEB850B39052B06AAB4805A96D62E98BCDD5F1C0BC7BD61363C33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe591eaa.TMP

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State~RFe591eaa.TMP
Size 1KB
SHA256 d186465bd7e96244d0428a5d2cb31e1a83915c2e607019470492cebef4004ece
MD5 80337293ff6fbc68cd21acf33dcd84c3
SHA1 9f738625b3e6489bac796bd79d3711c7be410d55
SHA512 8c80af1aa2fddfd204d58e4aa02f5ed8a33cc8d526e90b0247e625f5eacee66a0a0b13270a362331dccf4ce4cecbc9000d00c74f67439684ad34dba974bb6e03
TLSH
T18321B437E4142E36698A465AF3513A4A2F205037C3515E0CE6EC8B3C15CB6CA422BC3A
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

EZFN Launcher.lnk

Path C:\Users\Public\Desktop\EZFN Launcher.lnk
Size 1KB
SHA256 39ba20cc06dcbf2b7abeea41b037a3e9e6fb9e3f813caf61e39ff630916f077a
MD5 176e97feec0bd0e5cec7660d4a0ad91d
SHA1 21a0b9f02fff78ac76af03be778c4c41843fa39a
SHA512 34b73e921a5789bf5b44798eaceb5ad4508fbeb0a969eeaaca4d6a77cf04f5e213ebbef8383e62272fc88076812ab75fe68af91215b4fd85e32d5796330d57a8
TLSH
T1501180200BDA275DE377CB7459358F145B73BD09AA384A3F40C9E28646B5604CE2BF79
MD5 SHA1 SHA512 TLSH

Submit Download

e58f7d8.msi

Path C:\Windows\Installer\e58f7d8.msi
Size 7.1MB
SHA256 641082b5805ad60fe6493dd36bae8dfc390940bd1d15add162bef02345ff3f0e
MD5 e418e4a9cb75024e14e1ec3e6e91e0a0
SHA1 6d82c663a6dcbe522c2cec7152be8acf53832196
SHA512 b921d77f1dafe44a6018c9552c3e216fd86cbd6e3e0c758dee0db3e7cb142c0178b8aad11dd2432696a121cb6d496b49431e79d8fe024afe58e987890a855c7d
SSDEEP 196608:FrBn5fZ9AA/AwF532R11xsNqe7I85IYYF1V:FLrdFgzsNB7I2IYY
TLSH
T157763323BE84493AE5B50E76993E97515B3CBD204A24C4EB0384760EDFF42D12E769F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductIcon

Path C:\Windows\Installer\{4BB735E8-3588-4002-AEE1-43D83DEE70B5}\ProductIcon
Size 21KB
SHA256 e701c590c8ae73e0f31b5d9f1de78be78c757f8f1f9527c02281f56454265b37
MD5 ee03e934f65f1d6be1e3623550960da9
SHA1 a4db98769343948f34dd977cfdf56725dabaa836
SHA512 a2ffca8ae7a6b7bca608ec587ec939d1d5ebc2b962227e3268d4a373ab0005a3b542fe0c0348bfce6e1d9ada0f42252631ee4bfa35bc34e70bb181923a83dc24
SSDEEP 384:Fv2wTVGyeCwGDrgGcl5GPsNrHagyS9Wm3eKnR7FvDWrXxDAgkf:FvreCwGvcl19Hagy4nR7Ek
TLSH
T1E0A2D1DB7079B905FABAD635D9323298E6FAC22C1387C9D3948F43467D900C828B57D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 20c7d08b6192c2924007c3dd6badbf51022c81a1a4ec27eb1da71cb04a0287d9
MD5 0b7eddfd298d8bce62ec8872027b4a94
SHA1 cffc21e97ef07699a26c747afd77ade0bc2dabbc
SHA512 f1dd84fd3e1d93f2ddd6a784befb6a29230609283062d4e9ae4e24ee647d38a006278ba3cccbd3c86736c609f35dedeb579308ceb48648bcc387f84540ffa143
SSDEEP 24576:CEpmg3M0doO/vvTLTNvO1ZGBHsrRSXAJDPI9JDjd8aKjTmxfYa8mKjxkT4:Rw
TLSH
T16147E42436F92110F7F39E3CA8F06A674E397D57AC15DE8D05411B8E0862B71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a7cf5004-d69e-430c-9f64-3dca2ed64ab0}_OnDiskSnapshotProp

Path \??\Volume{b11be897-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a7cf5004-d69e-430c-9f64-3dca2ed64ab0}_OnDiskSnapshotProp
Size 6KB
SHA256 811f9ceea276252bd6ecdae02b236cbfecd0ee0376a335c9ed58c586de0f1635
MD5 0b7cab5f56ba49860b886b08275473e3
SHA1 04901f38bc86e6c3b83a6c69bac502acf46e8698
SHA512 c0f2b17c595c99a14a6452c8e7c6e0b1adf93c1ec454d6f81d3eadda217ec10f4e33a18cdf1c975e09df3c652900f6afb82eadaf6130ff13559e19e30e47a3e7
SSDEEP 96:FyDFYvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:wAb++ZVmN
TLSH
T161D198084AF54711E2B3AB3128F18557A877B911EF33CB8E0198638E6671910F836F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-691-0x00000294A9D10000-0x00000294A9DDD000-memory.dmp

Download

memory/760-876-0x00000294A9D10000-0x00000294A9DDD000-memory.dmp

Download

memory/1444-97-0x00007FFA62A40000-0x00007FFA62A41000-memory.dmp

Download

memory/1508-123-0x00007FFA62A40000-0x00007FFA62A41000-memory.dmp

Download

memory/1516-102-0x00007FFA645B0000-0x00007FFA645B1000-memory.dmp

Download

memory/1516-114-0x00007FFA64280000-0x00007FFA64281000-memory.dmp

Download

memory/1896-1439-0x000001771A000000-0x000001771A0CD000-memory.dmp

Download

memory/2364-797-0x00000202690F0000-0x00000202690FC000-memory.dmp

Download

memory/2364-1054-0x000002026A480000-0x000002026A4A9000-memory.dmp

Download

memory/2364-1055-0x000002026A4B0000-0x000002026A4EB000-memory.dmp

Download

memory/2364-799-0x000002026A4B0000-0x000002026A4EB000-memory.dmp

Download

memory/2364-798-0x000002026A480000-0x000002026A4A9000-memory.dmp

Download

memory/2364-794-0x0000020266FC0000-0x0000020266FEE000-memory.dmp

Download

memory/2364-1053-0x00000202690F0000-0x00000202690FC000-memory.dmp

Download

memory/2364-1052-0x0000020266FC0000-0x0000020266FEE000-memory.dmp

Download

memory/2964-1612-0x000001F8B2900000-0x000001F8B29CD000-memory.dmp

Download

memory/3052-1671-0x000001FCB5C00000-0x000001FCB5CCD000-memory.dmp

Download

memory/3844-1613-0x000002920F5D0000-0x000002920F5FE000-memory.dmp

Download

memory/3844-1614-0x0000029211700000-0x000002921170C000-memory.dmp

Download

memory/3844-1616-0x00000292192E0000-0x000002921931B000-memory.dmp

Download

memory/3844-1615-0x00000292192B0000-0x00000292192D9000-memory.dmp

Download

memory/4120-1051-0x00000133E4790000-0x00000133E47B2000-memory.dmp

Download

memory/4120-1265-0x00000133CBF50000-0x00000133CBF5C000-memory.dmp

Download

memory/4928-11-0x0000027F930A0000-0x0000027F9316D000-memory.dmp

Download

memory/4932-71-0x000002875EFF0000-0x000002875F0BD000-memory.dmp

Download

memory/4932-4-0x000002875EFF0000-0x000002875F0BD000-memory.dmp

Download

memory/4968-1262-0x000001E4DB3F0000-0x000001E4DB4BD000-memory.dmp

Download

memory/5084-5-0x0000000001440000-0x00000000016C0000-memory.dmp

Download

memory/5084-70-0x0000000001440000-0x00000000016C0000-memory.dmp

Download

memory/5168-872-0x000001610AE00000-0x000001610AECD000-memory.dmp

Download

memory/5168-131-0x000001610AE00000-0x000001610AECD000-memory.dmp

Download