77cd56844de4bc403b8b5fd921a295f639a932960665d31618f1395ffa6bd228

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/05/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EZFN Launcher_1.3.3_x64_en-US.msi
Size 7.4MB
Sample260504-evfp1sb17v
SHA256 77cd56844de4bc403b8b5fd921a295f639a932960665d31618f1395ffa6bd228
MD5 706c630a1461c1e2c42eae975a28b986
SHA1 9265d799175eeb39e4d842bf523eb5f127c96968
SHA512 822662a2e1d52508fd31abf9906ee7390ac289ff8864f4bc04b33f2b3228bd0b234a771a54b0796cfe988896c4e5c5dda38125519bae07b6d6862b0a41a50fd2
SSDEEP 196608:eZvzCsZWZNoCZR5kUS4m126mXHv8VKY2XH7112v:czPZONo6/kF4moXPCKBL112v
TLSH
T13676334B3E84A661D4A70D765875EB918F3DBC244B6489C32386B309EFF02D10FB65DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4388	EZFN Launcher.exe

Loads dropped DLL 1 IoCs

pid	Process
4244	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EZFN Launcher.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\EZFN Launcher\EZFN Launcher.exe	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\default_skin.png	msiexec.exe
File created	C:\Program Files\EZFN Launcher\Uninstall EZFN Launcher.lnk	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\Installer\e58a563.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1267855849\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1267855849\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1267855849\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e58a565.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1267855849\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_356080687\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1109258400\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5944_1109258400\protocols.json	msedge.exe
File opened for modification	C:\Windows\Installer\e58a563.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ED5C5759-EE42-4338-83F8-E608577764DA}	msiexec.exe
File opened for modification	C:\Windows\Installer\{ED5C5759-EE42-4338-83F8-E608577764DA}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4132_1267855849\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSIA6CA.tmp	msiexec.exe
File created	C:\Windows\Installer\{ED5C5759-EE42-4338-83F8-E608577764DA}\ProductIcon	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3044	msedge.exe
6052	msedge.exe

Checks SCSI registry key(s) 3 TTPs 17 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fdd572ac9dd26d3f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801fdd572ac0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e84101fdd572ac000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6ffdd572ac00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71fdd572ac00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223417841782465"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 37 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\ezfn\shell	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\ezfn\ = "URL:org.ezfn protocol"	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\PackageCode = "60959306AC750F547825A0F9396B9C69"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Version = "16973827"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\ProductName = "EZFN Launcher"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\ezfn\URL Protocol	EZFN Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2783838373-340812344-1280766377-1000\{5971F008-BEC6-45ED-9B92-554CEB216CB6}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD\External	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\ezfn	EZFN Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\ezfn\shell\open\command\ = "\"C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe\" \"%1\""	EZFN Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\ProductIcon = "C:\\Windows\\Installer\\{ED5C5759-EE42-4338-83F8-E608577764DA}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\PackageName = "EZFN Launcher_1.3.3_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\ezfn\shell\open\command	EZFN Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\ezfn\shell\open	EZFN Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298\9575C5DE24EE8334388F6E80757746AD	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2783838373-340812344-1280766377-1000\{77BC23CE-D7D6-4769-A986-8E40FF0CD28C}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD\Environment = "MainProgram"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\ezfn\DefaultIcon	EZFN Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\ezfn\DefaultIcon\ = "C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe,0"	EZFN Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4016	msiexec.exe
4016	msiexec.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe
4388	EZFN Launcher.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
4132	msedgewebview2.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	696	msiexec.exe
Token: SeSecurityPrivilege	4016	msiexec.exe
Token: SeCreateTokenPrivilege	696	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	696	msiexec.exe
Token: SeLockMemoryPrivilege	696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	696	msiexec.exe
Token: SeMachineAccountPrivilege	696	msiexec.exe
Token: SeTcbPrivilege	696	msiexec.exe
Token: SeSecurityPrivilege	696	msiexec.exe
Token: SeTakeOwnershipPrivilege	696	msiexec.exe
Token: SeLoadDriverPrivilege	696	msiexec.exe
Token: SeSystemProfilePrivilege	696	msiexec.exe
Token: SeSystemtimePrivilege	696	msiexec.exe
Token: SeProfSingleProcessPrivilege	696	msiexec.exe
Token: SeIncBasePriorityPrivilege	696	msiexec.exe
Token: SeCreatePagefilePrivilege	696	msiexec.exe
Token: SeCreatePermanentPrivilege	696	msiexec.exe
Token: SeBackupPrivilege	696	msiexec.exe
Token: SeRestorePrivilege	696	msiexec.exe
Token: SeShutdownPrivilege	696	msiexec.exe
Token: SeDebugPrivilege	696	msiexec.exe
Token: SeAuditPrivilege	696	msiexec.exe
Token: SeSystemEnvironmentPrivilege	696	msiexec.exe
Token: SeChangeNotifyPrivilege	696	msiexec.exe
Token: SeRemoteShutdownPrivilege	696	msiexec.exe
Token: SeUndockPrivilege	696	msiexec.exe
Token: SeSyncAgentPrivilege	696	msiexec.exe
Token: SeEnableDelegationPrivilege	696	msiexec.exe
Token: SeManageVolumePrivilege	696	msiexec.exe
Token: SeImpersonatePrivilege	696	msiexec.exe
Token: SeCreateGlobalPrivilege	696	msiexec.exe
Token: SeCreateTokenPrivilege	696	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	696	msiexec.exe
Token: SeLockMemoryPrivilege	696	msiexec.exe
Token: SeIncreaseQuotaPrivilege	696	msiexec.exe
Token: SeMachineAccountPrivilege	696	msiexec.exe
Token: SeTcbPrivilege	696	msiexec.exe
Token: SeSecurityPrivilege	696	msiexec.exe
Token: SeTakeOwnershipPrivilege	696	msiexec.exe
Token: SeLoadDriverPrivilege	696	msiexec.exe
Token: SeSystemProfilePrivilege	696	msiexec.exe
Token: SeSystemtimePrivilege	696	msiexec.exe
Token: SeProfSingleProcessPrivilege	696	msiexec.exe
Token: SeIncBasePriorityPrivilege	696	msiexec.exe
Token: SeCreatePagefilePrivilege	696	msiexec.exe
Token: SeCreatePermanentPrivilege	696	msiexec.exe
Token: SeBackupPrivilege	696	msiexec.exe
Token: SeRestorePrivilege	696	msiexec.exe
Token: SeShutdownPrivilege	696	msiexec.exe
Token: SeDebugPrivilege	696	msiexec.exe
Token: SeAuditPrivilege	696	msiexec.exe
Token: SeSystemEnvironmentPrivilege	696	msiexec.exe
Token: SeChangeNotifyPrivilege	696	msiexec.exe
Token: SeRemoteShutdownPrivilege	696	msiexec.exe
Token: SeUndockPrivilege	696	msiexec.exe
Token: SeSyncAgentPrivilege	696	msiexec.exe
Token: SeEnableDelegationPrivilege	696	msiexec.exe
Token: SeManageVolumePrivilege	696	msiexec.exe
Token: SeImpersonatePrivilege	696	msiexec.exe
Token: SeCreateGlobalPrivilege	696	msiexec.exe
Token: SeCreateTokenPrivilege	696	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	696	msiexec.exe
Token: SeLockMemoryPrivilege	696	msiexec.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
696	msiexec.exe
4388	EZFN Launcher.exe
696	msiexec.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
5944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4244	4016	msiexec.exe	86
PID 4016 wrote to memory of 3592	4016	msiexec.exe	90
PID 696 wrote to memory of 4388	696	msiexec.exe	93
PID 4388 wrote to memory of 4132	4388	EZFN Launcher.exe	95
PID 4132 wrote to memory of 4028	4132	msedgewebview2.exe	97
PID 4132 wrote to memory of 4328	4132	msedgewebview2.exe	98
PID 4132 wrote to memory of 4328	4132	msedgewebview2.exe	98
PID 4132 wrote to memory of 4328	4132	msedgewebview2.exe	98
PID 4132 wrote to memory of 4280	4132	msedgewebview2.exe	99
PID 4132 wrote to memory of 3832	4132	msedgewebview2.exe	100
PID 4132 wrote to memory of 3832	4132	msedgewebview2.exe	100
PID 4132 wrote to memory of 1420	4132	msedgewebview2.exe	101
PID 4132 wrote to memory of 1420	4132	msedgewebview2.exe	101
PID 4132 wrote to memory of 1420	4132	msedgewebview2.exe	101
PID 4388 wrote to memory of 1604	4388	EZFN Launcher.exe	102
PID 1604 wrote to memory of 2840	1604	msedge.exe	103
PID 2840 wrote to memory of 4304	2840	msedge.exe	104
PID 2840 wrote to memory of 3044	2840	msedge.exe	105
PID 2840 wrote to memory of 1836	2840	msedge.exe	106
PID 2840 wrote to memory of 1836	2840	msedge.exe	106
PID 2840 wrote to memory of 1836	2840	msedge.exe	106
PID 2840 wrote to memory of 228	2840	msedge.exe	107
PID 2840 wrote to memory of 228	2840	msedge.exe	107
PID 2840 wrote to memory of 5176	2840	msedge.exe	109
PID 2840 wrote to memory of 5176	2840	msedge.exe	109
PID 2840 wrote to memory of 5176	2840	msedge.exe	109
PID 2840 wrote to memory of 5188	2840	msedge.exe	110
PID 2840 wrote to memory of 5188	2840	msedge.exe	110
PID 2840 wrote to memory of 5188	2840	msedge.exe	110
PID 2840 wrote to memory of 5244	2840	msedge.exe	111
PID 2840 wrote to memory of 5244	2840	msedge.exe	111
PID 2840 wrote to memory of 5252	2840	msedge.exe	112
PID 2840 wrote to memory of 5244	2840	msedge.exe	111
PID 2840 wrote to memory of 5252	2840	msedge.exe	112
PID 2840 wrote to memory of 5252	2840	msedge.exe	112
PID 2840 wrote to memory of 5540	2840	msedge.exe	115
PID 2840 wrote to memory of 5540	2840	msedge.exe	115
PID 2840 wrote to memory of 5824	2840	msedge.exe	117
PID 2840 wrote to memory of 5824	2840	msedge.exe	117
PID 2840 wrote to memory of 2056	2840	msedge.exe	119
PID 2840 wrote to memory of 2056	2840	msedge.exe	119
PID 2840 wrote to memory of 2056	2840	msedge.exe	119
PID 2840 wrote to memory of 4764	2840	msedge.exe	120
PID 2840 wrote to memory of 4764	2840	msedge.exe	120
PID 2840 wrote to memory of 4764	2840	msedge.exe	120
PID 2840 wrote to memory of 5424	2840	msedge.exe	121
PID 2840 wrote to memory of 5428	2840	msedge.exe	122
PID 2840 wrote to memory of 5424	2840	msedge.exe	121
PID 2840 wrote to memory of 5428	2840	msedge.exe	122
PID 2840 wrote to memory of 5608	2840	msedge.exe	124
PID 2840 wrote to memory of 5572	2840	msedge.exe	125
PID 2840 wrote to memory of 5572	2840	msedge.exe	125
PID 2840 wrote to memory of 5588	2840	msedge.exe	126
PID 2840 wrote to memory of 5588	2840	msedge.exe	126
PID 2840 wrote to memory of 6024	2840	msedge.exe	127
PID 2840 wrote to memory of 5980	2840	msedge.exe	128
PID 2840 wrote to memory of 6024	2840	msedge.exe	127
PID 2840 wrote to memory of 5980	2840	msedge.exe	128
PID 2840 wrote to memory of 6012	2840	msedge.exe	129
PID 2840 wrote to memory of 6012	2840	msedge.exe	129
PID 2840 wrote to memory of 5788	2840	msedge.exe	130
PID 2840 wrote to memory of 5788	2840	msedge.exe	130
PID 2840 wrote to memory of 5788	2840	msedge.exe	130
PID 2840 wrote to memory of 1084	2840	msedge.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\EZFN Launcher_1.3.3_x64_en-US.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:696
- C:\Program Files\EZFN Launcher\EZFN Launcher.exe
  "C:\Program Files\EZFN Launcher\EZFN Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --no-proxy-server --lang=en-US --mojo-named-platform-channel-pipe=4388.1992.1271268587607976693
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd83b0b078,0x7ffd83b0b084,0x7ffd83b0b090
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1828,i,17903100979806468695,14562215550663803145,262144 --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:2
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1952,i,17903100979806468695,14562215550663803145,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:3
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2372,i,17903100979806468695,14562215550663803145,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3040,i,17903100979806468695,14562215550663803145,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:1
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4532,i,17903100979806468695,14562215550663803145,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:8
      4⤵
      PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
      4⤵
      Drops file in Windows directory
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2a0,0x7ffd8537c188,0x7ffd8537c194,0x7ffd8537c1a0
        5⤵
        
        PID:4304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,14259272142543586136,17202957344596498282,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,17211367428397993682,3578295143279410467,262144 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
        5⤵
        
        PID:1836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,15943432960072261707,14033714066455627203,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3276,i,16475902689828660555,10098329640453561717,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        5⤵
        
        PID:5176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,4659679895234211950,8803765210393724836,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        5⤵
        
        PID:5188
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,18439870522518937398,4829091575156640382,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
        5⤵
        
        PID:5244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,11820816426115308545,17907892855002297656,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
        5⤵
        
        PID:5252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,9506854965789876312,3606397162710708562,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:8
        5⤵
        
        PID:5540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,10890541476879471893,15969591009973660783,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
        5⤵
        
        PID:5824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3576,i,18370250027615542616,17967558085868893319,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
        5⤵
        
        PID:2056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3504,i,256809223382792877,5870178112129676860,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
        5⤵
        
        PID:4764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,2178507180062591938,10964719344056197587,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
        5⤵
        
        PID:5424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,12918117612183269591,15791382049697283591,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
        5⤵
        
        PID:5428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,17412556370113607428,16076715739119247793,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
        5⤵
        
        PID:5564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,17412556370113607428,16076715739119247793,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
        5⤵
        
        PID:5608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,10220288167377859403,10208168294428117758,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
        5⤵
        
        PID:5572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,1353983004796592148,8254323312235709182,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
        5⤵
        
        PID:5588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,17613871200301255905,8449822526763711001,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
        5⤵
        
        PID:6024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,4769642623168642849,1608304594109525030,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
        5⤵
        
        PID:5980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,2816379433739548222,9299293079312424020,524288 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
        5⤵
        
        PID:6012
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4324,i,3232051582655084940,7427919436633273758,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
        5⤵
        
        PID:5788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7024,i,3528614709633963820,4996976216939932344,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
        5⤵
        
        PID:1084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6400,i,6732582656375067264,6905495600281798746,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
        5⤵
        
        PID:5412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7020,i,7516086619297041966,13047721158864433332,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
        5⤵
        
        PID:4956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6388,i,14601356938649101435,16013242393644631933,2097152 --field-trial-handle=2348,i,7232224962542542051,12604849233158710915,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
        5⤵
        
        PID:5980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x300,0x7ffd8537c188,0x7ffd8537c194,0x7ffd8537c1a0
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,15191617884093970219,10505761261359989087,262144 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,1681790216772342681,6895516483667297332,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
      4⤵
      System Time Discovery
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,9194081110079086763,13855344490636997642,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:8
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,12905234441789767931,7315975909376300616,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,2291226092386039525,2605500196775700168,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4928,i,9505442501135258611,9462114493998779992,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5416,i,326024580418345297,15858043011906279220,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4984,i,2829729768763872510,12642353416454392049,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5676,i,11936557921655218304,10439965469280783312,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5728,i,2693670749066161088,16796314713112504158,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
      4⤵
      PID:600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6152,i,10952012981313365131,5390015024267899673,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,18278307552193324887,14994761012275719909,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,8432953490239715430,11469457989477821978,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,6256848984427793183,15240771517958377488,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,6256848984427793183,15240771517958377488,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
      4⤵
      PID:3708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,6290284672863638023,8111047247508130953,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
      4⤵
      PID:6308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,2841373826217313124,6423899565645800178,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
      4⤵
      PID:6316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,9275813516663851244,6631797300038558034,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
      4⤵
      PID:6324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5456,i,14754754800537410887,18386504786875917018,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6944,i,14552214433746510421,11996195973577236133,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5100,i,1766919583703710051,15635673860819549332,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5416,i,10754104187500236949,783092686634054751,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3460,i,10125211431865471052,12580570132004070901,2097152 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7208,i,5597050947378915173,9402372722891682447,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,11843042129299439730,11573246989698911400,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
      4⤵
      PID:7060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=904,i,1544054274040922216,17333859450495430625,524288 --field-trial-handle=2268,i,2958421967668481298,10062586865092103176,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
      4⤵
      PID:6040

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E76FE0DFBEB0EF98A3232977F77907E1 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4244
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3592

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58a564.rbs

Path C:\Config.Msi\e58a564.rbs
Size 10KB
SHA256 555119e8dd770dd9afddfa64916610ce51974729c0f95d206413a5747f3795ee
MD5 6c945cd09f5331faf24de5e2af0b1a45
SHA1 9ee8c18530e4903409f7a4fddf35efd4a9912883
SHA512 89e2be89e6e55808501069cfcc22b9ed4ce247fe58c0c79b09915f91f501025fb42e4b96fb82bfb3732d343d96b64a2f407cc691229a9eaf73ec970055efd1fa
SSDEEP 192:SS0CeCSCQCfCNgCblzPeDesPPeG7ysPPeT+7//iFLDWyi0/z/5hppSP:SUVRvaFlgMgfjUrk
TLSH
T1EA220042F50081D2FCD61B71E30727653FB3D7CA670A574705AEA9718F86B942FA81CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Launcher.exe

Path C:\Program Files\EZFN Launcher\EZFN Launcher.exe
Size 11.4MB
SHA256 3dd8c79514ac61b139d7236a9e760bf8ad4621519e72d78f3631c9a322a923c7
MD5 96d67208707f94c6780dee71fca3dc8f
SHA1 f4e93c415653eb1f055a8a3b207de3eaf0021580
SHA512 b3722d8802cccd8d63052a577607b32a48210135df7a353159cb8d53e7f4aaf73673c7d308bb557f978c9efb97e9a9643e8d78d4e47135c2ec1b5c596a28aa5e
SSDEEP 98304:afpRPMP+ImHjxdyD66ComQOBYM5FB46uIbvvnU1gwZuXbfbVSOS5naiNHT62ReMO:sYV9CVXbfbVUnf42RWg1Nsep8BLHPNM
TLSH
T197C6AE03F29181E8C0ADC478835BA637EB32BC8D4525B25F1BE44F612E66F60AF1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk
Size 2KB
SHA256 dd97d3963c430ee324059a869b655d4fec6e3708a2cdf26d7076d54707984966
MD5 cf5651d9262dcc03dc7a19d03224a6f0
SHA1 67ec55479aede595e76a989d679699a9c488e914
SHA512 a5c4a1df3eec9afe135d7215dc53c03f6cc243081037b6c208047782ddf90502e63b03bb27c158c464fd9463561028017e3048767db06015c82471a974041554
TLSH
T1B2418A205AE5676DE3728B319A3187019B72FC0AB5399F2E4189D1820875500DE79F7E
MD5 SHA1 SHA512 TLSH

Submit Download

EZFN Launcher.lnk~RFe58a7c4.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk~RFe58a7c4.TMP
Size 1KB
SHA256 8d0f5d66ee49a7cf9f51c96f85b72d50621253f73027b041ef6d4a8be6406be4
MD5 f3647b26f46f1cfd38d7fe0934f9c59f
SHA1 28fd698e3b59fbc5a7719150ff47e8785eeefd48
SHA512 90dcc45902c630416c7716133cca65d6dcb736407f7df28071986d520a7637858914fcdd1e2bafc6746d221bf2fad3ff109ddc9f038bfe74f58d653690b06cd7
TLSH
T1964188201BE56BAEE372CB31993187019B72FC0AB6399F2E418AD1820475500DE79F7E
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44e9a43c63982734361d58f6dbb1502c3d740628b05ab5bec57406bde04add60
MD5 723a748e44caadd71195ffe4e217722d
SHA1 7c7f1c75f1efbe6ba044a556d11f863c98b2acda
SHA512 44b8b021f13d2c8587120e726b58a313a8c6936ade23d6930d74e692ecbb5ad90bf9aaefec94e7110419575515c29551e0ec9551d3e4937f1f999d88b062c3f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8621320c11c1a0e2d9c39bdb8fe8cacdc268e0d539e6f2ea624203992fd917c0
MD5 7e38762fb220a3ff61ed1c11e6d5ea12
SHA1 a08c5dafb02d3732f58446251d8368029a39ff2f
SHA512 18955ba0144000f2e1cdd2d16cdbd4217191073a8af4ed152fdb5505db978b8eb232eb04ec1d6ccf88b47b1db75f26d321939ffa4f5dad24583ea80ab2455b41
TLSH
T1B1D0A77AA3AAD402CAA605F141115A912687D14A308F81C5D115540D54A9A4967D2297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9b8dabb1e4a4b08ac70563cc9dcdaacb1771916efce50205313622ae6bc7a640
MD5 13e474663f8849f69fad0847aafeee27
SHA1 f49be3fc5f8e058089291b3deed4507b75ce6b0e
SHA512 4cb63d790267cfd7901ea035ca6cfa490499d77b22943848b29c3a5a776cf734411f8070e891ce1c43ff47cb82efb3a5f10d90985b79e3cac66ce17e495f7d8e
TLSH
T1FDD0A736637E8802CA9209B551024F8137C6D15A308E82C5D2112C0DA463E16A3DB243
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 16de2b7ebb3f5da2bb60fca124bc61d7ec1f3ae51382993ae42829a5beaa97a0
MD5 9e5c3c9ed178be26975baf744bbf44a1
SHA1 6948e0b0b021be2a6b761bafe456995b92d1b07e
SHA512 4a2ca93d4fadbb5c2097c17739e5c08b9ce680ff3cbd29b68e12017796d5a2f4a961fc086af285fc11104131e909154ad29f30dea8331350910b7a48247ccc14
TLSH
T12AD0A736677EC802CA9209B555014F8137C6D19A308E82C5D2152C0D9463E16A3DB243
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b5ec46fa431794c7d59f9fc0057e1e3e3b1af4e12dff7d68bc94d155efc6ffec
MD5 5c96a0e845475aad3c0a3e922859ed30
SHA1 ea2be21b4e96a8a5ec42464f68d775342fb34bbf
SHA512 725cd4d35913c01a0e1c8a8b8f0ea365645f9ce7b622b047d3bafdbbcecd02dfe38c58f9ea0f30642ac6afcdb3dd6bc636132cf52b13f84a3535ead27209fac2
TLSH
T1D2D0929E52A68C22CEBAA6B0114A2F892296D51A410AD38AD43228181D9328669C6296
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9b4b644a6d0e658838d87f47f679cce5368e7cec46064a4bf3d8d2cb1bb1c32
MD5 62ac481b0a7e76afd75b774dce51082d
SHA1 8e75d15d042e2f4592f0e1cfbe7c6026d6c1fd2f
SHA512 d0f20529220d52336501d06acdc623fd7e8bf5e9f66e083561a68ef1e77e8bc534b1bf060ec9cba3c8d55410fc489087b1852cfedcff4c473c5b044950986f84
TLSH
T1F0D0929E92A68C22CEBAA6B0114A2F892296D51A410AD38AD43228182D9324669C6296
MD5 SHA1 SHA512 TLSH

Submit Download

359ca2ce-f3ac-4cbd-af90-c1fd5ed51751.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\359ca2ce-f3ac-4cbd-af90-c1fd5ed51751.tmp
Size 414B
SHA256 83d71a52263b132da459a5a9cc0a9cbe68f091da0c6c213e84e1586026c9365e
MD5 b68248da0568832fb28398f1e4d5d7be
SHA1 1d3700c460c0671d856e7790a4bb59f850f7c437
SHA512 96ff28cff4b4ab5b55c65f077aab1b12c33d962fe924f11afbf74372dd80b391baa56e4d31645af673be4eb8cb8aaf93ad6e1e3e0292dbe0f09e2dd63228826a
TLSH
T14AE02BFECD249C3708FD1719A8524A41E694131B3A92995F363C460C8F70A3B018AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 157KB
SHA256 bfdb0702e2816cb3e884ca306f60864a67dcc7850a2bb35d62bfcf0ac1b3efe0
MD5 06b9ca8a067460c6f2fb7df13dd68be5
SHA1 32b82261c737207662ab4ec9153ed738b56549a1
SHA512 888c0caab9d3a2451e177d7ec9224ffd48ea0cbef45c61c5f8b09896c7737f7d7f40b668a85dd770d5bb4c8a6e8376d597547e9ef94ccfbec815909aafdc3da2
SSDEEP 3072:2YD1DIGvTRcJDU6cwDQz/KvJor/Hg4Ouq05hPZPglZMu6vjCM3vhknDIf2SaQ0T:x7vTRc7cwuiY605hmrMu0vZiw2SaQe
TLSH
T1F9F312837DA7C13034DBAA6B6E34656F8D1A426179F6A4BB73E806CC901D7E86360436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 68947d6580f109e3ed8a2d8686583973125d8f0b401aef1eb3fb47521e18a704
MD5 df0a9252e88ff27f6eaec8d145509a62
SHA1 1308af16793743a7a96ab6624d2562dfedf49ef9
SHA512 6823d9270a761d76ea68005a8e76f9f1549ea5e9e8a84226eb918eb0d84bb94a5c019cc433b30099a55f0f4fde4568b4422a8fae4c6c4e9cbec36e1c1bbd8736
SSDEEP 96:o84PAfaXr2tBUMUmk+xAPZBek3EASsAylCi9m1c:otPh2TTUm/xQ8vsAyb9mm
TLSH
T1009192CA6E83AE1DDBE040B576DB12477B311118A35B0E2DB1D1443D5AE2F2BAC435F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 23abb027611d9e2f20b816861015bcc269b401d568d1c343d3e9723ff752bf17
MD5 e087c0605488fba423e07ea55ab74191
SHA1 f70a3066dd3cacdf7855b4a01af479cd350bb9ec
SHA512 b76503a27495af3843c707a9bda6e29a8c9a3cf1d7c5e48ea14ca3a37a50976add2df04f98ac07df707b352b7d359af898f7b0dd8ca0ac3126b9f4f4e5c20115
SSDEEP 96:/8UCAaaXtR2tBUNUmk+xAPZB/G3EASsAylCi9mz:/hCCR2TaUm/xQtvsAyb9mz
TLSH
T16CA181C96E836E1EDBE044B576DB1247BB312514A31B0E2DB5C1443D5AE2B6BAC434B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 830ce3cc3632c440dad7eb819338548f242f3b765959477634041c52dadfb53d
MD5 03704c481a3cffcaee0d1007df3fff70
SHA1 afae3b087bb5cd29e28d1930c6fa482c5261dbaa
SHA512 53c606ddb8598f9fe7332a638ee9d43a2598d3e6c0cdf7ec5c582704fe7e3e50b247757b42391114c46395b9d82d36baed29ed25b0354cd366eb1e15585b2efe
SSDEEP 96:a9lCoPNbmTcsBp7afu30pcU6UKC+UwOcxmo:Glx0TOGkpcU6UKC+UwOY
TLSH
T1B28171CAAE869C1CEBD004B57AE306477B366114831B0F2EE191843D67D2F2B8C435F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 203052593a1f37073e1a67dbc7de58203758c4d799b872b90c7f9d35fd5d32e5
MD5 51cece02f04debe7c69a71698bb5d3d7
SHA1 d925b6521d7d7ba5bf33e48492712c7f3c22c878
SHA512 6f16823241959760a30eb286a1142e151e768ff2717afe9f46d7c6e925a8f15a2c799fc73a9ec1faad4af40df84b16c2ed5bd7eb3775fb8229d110b7e4520cd6
SSDEEP 96:+/84OAfaXr24BUMUX+xAPZBXy3EASsAylCifM:etOh2UTUuxQZvsAybfM
TLSH
T1419172CA6E826E1DDBE040B5B6DB12477B316514A31B0E2DE1D0847D6BD2F2BAC435F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5914d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5914d6.TMP
Size 3KB
SHA256 14f9cc28c2066de03588fab5298ab98a5639229799c991c0e73a1e12cad61c70
MD5 b314ad57449d26660b4ee759ec574a71
SHA1 9c45f0349a72eaff5e700f0aa049a5bc1f01be2a
SHA512 06d3937f02318893cc00381048a4e5a7d626bdb7dc8fcddd3c18ac4710ce4588a203e2237ef3b1a34c2a9cebc9307e9c2faa033064203999a00c2cd7c5c1bfe9
TLSH
T1F861B4C4AE858C2CEBE040B5BAE701477B34561893170E2DC5D5943D4BE2B1BDC838F1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_1\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 499995bd1bb23aa3efd65b74e084cf32db46fa73064804c452b4e60bea8127b3
MD5 515925025a277822c6ff4a67a0bcf28f
SHA1 716fc35faa9975e6fb823fbaa88835e6e33f1861
SHA512 99aa0dcb110323a79189ef37971d7a3b0e7ba91e27f4a0d7475a15c84d80efb7b00dcfcc62b5a45d0a17ce09f96d048e85633e466f5263f7b134aff97070b88a
SSDEEP 48:uzBmw6QU1Pzesfcgp/a/PBTroPrW4BWaZwUgBOjmc:6BCxAi/a/PBCWaeUgBOyc
TLSH
T1CE9294431E793423E7511E7F36AF1876C83B925C9FA6AD29317418725DB840184389AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_0
Size 44KB
SHA256 226d94109d73eb4ebe2b6f3b0b560f80043f05c5b3a93ded868d3b39dbae29e2
MD5 58a5da2d1a668b4841de864a1b589bb0
SHA1 7bb9f92f753cea53a1ed4c8eb534887097dd8559
SHA512 e088691842732835f3d741d02e69ebf1fc995089b047c385c405184d1f8f9502099e7673e68f29b9c47cd607c133c5a4433f4d2eea0fdacaa6267e261fe40a6d
SSDEEP 6:/Fii2QGNLUkM/lsxjbnbXhamM/mfk+t6TJC:dZGNhEojbnbxa5OSJ
TLSH
T1C313123E47D2110FC70B6031DC488BF45B32D9C416973F2EB6A96074ACC81050463151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 8464fbc44ddcd967935b7fa8fe15abe071d253f512a527f02c4ce30e795b42cd
MD5 a80ff0853471dea2b085ffdbddef0335
SHA1 db2862a1d7b0a5709ab923a2f69a7b34328b85d0
SHA512 8cf532ae952395da0e841f8a102824b9342ccc76dbdbf6ce5b11aeeaac2020c706fed7d91ad39db212e209a6b581ce2ac2003de592af7484521922721c82ddf7
SSDEEP 12:U/M19GrXkpzJW29RMgODAX8wALpzJW21XyQF1pzJW2l7kpzJW29mIwYpzJW2y:JDGbgV5RLODA8PV0QFjVxgVw0V
TLSH
T193446D23BC504C42F427C6B5BE325F6AEA6D91DAD2973B1363140268ADF2CA58FD1485
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2
Size 1.0MB
SHA256 3b8ed88cbe33add570dcb000d9db8ca4476550f46a870e22ae5942515af30bc0
MD5 3967158e41d11567e19c6734753b01eb
SHA1 74170f5b022aa0b1b6d184ccfeb9e395409d07dd
SHA512 a2537b3eafc851e7c8e775591ba8e05dd173829100b3ff4f64daba2846f77718e70b4e9700b2c1eb0c2ab6ea1f860d25d1cd2e49ec413d1cf7880271b4803575
SSDEEP 192:MdxZdCEYENlyZysnEYRwymUWLTgBPl/E6Fwlyp7L3sgi72jl:4j2ENlQdbVy8bsG7LViC
TLSH
T1BE25B0F6769207CAE28AC473243614EDDE3717278965391D890901E5B7CC3469E82F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 30d9896611e0234175ddb25e251a8c1f21bb9e038609f6cfeee2c6bf4a42263a
MD5 5864287f7863b048a85cca766a1fd324
SHA1 e59eb301504504190e611418e3d6935eb0e878f1
SHA512 bb94c46870b12d160b21547f92eedeb787457c40a86666093e3232d8612f39d640a7f71989ab3568f2eaab9602eef1342e4ee8fc8eb750776828b8233830ea21
SSDEEP 96:nEj4IU+bGz83uy3+u4tgp4DLjGQLBze9z3+jBHMsDEuspU0wbtqrOQpPfR4J+MCT:nQ4f+G83uy3Ct7XBBK+H7DXspU3iV
TLSH
T1DB14100E4F243721CDBD917668E744B35D6CF03FCB1266DA686114B4CEE2A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 b20fd212ee25d48496053960649029e3f41dfbae1db1f91b0e350bb64ea54678
MD5 e0e7e43506cb9460e07f0739fbc7dbbe
SHA1 e9b0237116f831252c3a7d700a332f227f23d832
SHA512 4aa86425a21cabbad2b930e26199bd3fddb90f496f9551451b3ba3da623b3ae67779cc39ac2e40e055731dc6cb9d08abe445cc01c506bcb165c00261686c2f28
TLSH
T119E0266148CDC13E6614A0CB83787B0ED7F0755AE68C3F821F04E84CB041424B7CA7E6
MD5 SHA1 SHA512 TLSH

Submit Download

6b7459ae-26b9-4cdc-ba73-213d62c7dcae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b7459ae-26b9-4cdc-ba73-213d62c7dcae.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 f9f6750b7544aae18cc46ec20b2bb7cd65035dd872b59d23b94a9302d104b74c
MD5 21f2fbfffbc2dad5e9f889f9f3c98955
SHA1 8f1ea4df99c104e19ecb0b3253817ce6a08c997f
SHA512 34c65a2f8053ac135c2672a04771d754a79bcde05aea053d32fe88a6cd4031263f9d494797a346f19f2b039259a9ecd4e0f5b8688798af1e0f8526228e39343c
SSDEEP 192:DGS9HfJ4UCOGe+5JGJsJ6bvXbTeJj6OiI0OGg2PCV7jX0Fqbo1hezIzPnU2AE1u3:DGS9HB4UCOGe+nGJsJ6bvXbTeJGOiI0+
TLSH
T1001280F7C7E4866ED92152F1AA183E2BDE2E0D95432C3C1A86E4DF4B93F1470E24195E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 b6c58ea2685911f96de812e912fc4646e59c5da88bf16ee93fdf5bcbfaec075a
MD5 914a077801762ea0e9d6dbad285de417
SHA1 6a17979da29379e30632234c11a4a440883608c1
SHA512 738db3008fb1d4629c2b335f51217ac3f7cd5f5a54a2c8301286025ae7bd2375a038f7cc437ba8e31da889a44d8c0d53a7b0c95323663825b809b3406e4dc611
SSDEEP 192:DGNS9HfJ4UCOGe+5JGJsUXbTa0OGkqw/Gj6QoNhn2PrUedeE+zVKzPIZPipvqd:DGNS9HB4UCOGe+nGJsUXbTa0OGkqw/GG
TLSH
T14802AEF3C7E4866ED92152F1AA183E2BDE2E0D95432C3D1A86E4DF4B93F1470E24195E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 37cba369a03989069b872eb93ea036a357e6cf940a032abc5b110c28c432b928
MD5 a7d4360dfc85a05f66526cabbda27bc1
SHA1 f89ec1842e552acd0bd5c83e4e0ce552a3532b27
SHA512 12facaa054bd72cc847f83745533407f0243608a97966aa7d4f724d38e33d8642cb314449d9878d94fc04f32f95aa9c97027c36b5eb1a1dd8026b694c91c1c3d
SSDEEP 384:sxZ82fMf/f3sgWvPG3wOARSHb/1GT/blY:slEf/fvYO37Hbda/u
TLSH
T12D82E956AA3849BB8CDBD219F551FB63D6F5052292904E44AAFCCB0C11E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 92111d7cac9e6b59c2788ba601e5d51f064a8058e0d55498a5cd9e4c48a8b672
MD5 a6aa01f6c6771bc99e9f3249890fd061
SHA1 a6b14b6c3d4200b1e0d4d38f73d76cabb7c98bc1
SHA512 175153f6978a15535d0a114763e9a9d2940479b112a97e94385f6ff916ac2f39400566eb54dbee3b3998b05d3c0961798cd999223216b7b6d25f0a4ff31387f6
SSDEEP 192:sxZ8yRxyM//K1Ml8Mif/f3s2G0PBOzIdpZGHW6+WNuTI/z4NXIX+tUa3JB/xf70u:sxZ8yPqf/f3s2G0ZOs4HbJ/IVRec
TLSH
T10262E957AA3859778CDBD219F515FB63D6F5056292940E48AAFCCB0C00E6EED2107C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 47b35fbff5ad5be41fd98d9b23d5c6a8958bda59fca3e3ef77d08ac149d28c81
MD5 2b50127ed11deb6f82b8263614c1d42d
SHA1 26c72c1932ffa082f2949a10cab36fe10350497c
SHA512 d0a8bfd06777f217e1cd8e88d4229d474662f61fde63f1ca02bb3549de57a2a61b59f87a40b17807de3955c278442a2e4bc3ad5d62bca70b0b22c986c638d5d5
SSDEEP 192:sxZ8yRxyM//K1Ml8Fjf/f3sVWpVhG0PBOcIdpZGHW6+WNkoTI/zSyNXIX+tUa3Jp:sxZ8yPMf/f3sVWvhG0ZOF4HbW/1VbcC
TLSH
T13372E957BA38497B8CDAC219F955FB63D6F5042292944E44AAFCCB1C01E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e4b51ec9fdbc8ad155b63f9fd1df79a86c6cf754fbe82d0f0a6ee39a3f303f9b
MD5 7e65001d141aa58e49fb212b5b3715ea
SHA1 8a3f473ad8b92213d6433cc2639809c5bc645e57
SHA512 759946bc74d38d9f0d762ba80cd5e9f36a1a30c31c31c7e1cb414b6a280504635a3d1fdabaff418fe88611c319644e17da08630aaa0abacf4f3d41a8bea1f75b
SSDEEP 192:sxZ82RxyM//K1hl8Fjf/f3sgWpVPGNPBOAaTzodpZYHW6+WNkoTsfzvyNXIX+tUu:sxZ82QMf/f3sgWvPGNZOARSHbWfeapbC
TLSH
T19272E956AA38497B8CDBD229F955FB63D6F5052292904E44AAFCCB0C01D6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e6eee25b6752ecfc89d5173bed227ea369d0bb39a401590ae49a661841c77dd3
MD5 4126a059d4a2cdc4ae545204fbf201c3
SHA1 72ab438815043ef433d4d47d729392b2356c9908
SHA512 460d3111e943fff17932fdb1f9a30e810d69671113b9af2c5208e1cf8b7199787de1e2caa571e44193437588f59b948d0593980e7544a42a77fdeed30f443944
SSDEEP 768:C28Ifmq7pLuLn37WvjdCx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVttOyLlsu7FhroH:C28IfmCEn37WvjdCxu1jaQtOyLeQFaP/
TLSH
T17EF20B3B680CCB7E4F804EDCDC2ABE9A6DE8018F9698899447FA441C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 d75e39c26ed94bf545897c44668c7af841dd62dcabbec0f504bbbdde42357d81
MD5 4d2f90d845366fea838e597dcd670cee
SHA1 1dc652128c7786eeebf2c9848d28d43331d8e0e2
SHA512 7fbab73528f3890c5716dfd8791a1f0ae484902ef48c17040aa29dede16ef220df11bc1c118bf24c3826a6ddf2a45d3c7aaca703414bfa7bee113dce03fe80b8
SSDEEP 768:CKIIfmq7pLuLn57Wvjdex8F1+UoAYDCx9Tuqh0VfUC9xbog/OVttYyLlsu7LhroC:CKIIfmCEn57Wvjdexu1jaQtYyLeQLabO
TLSH
T104F20C3B680CCB7E4F804EDCDC2ABE9F6DE8028B9698899447F9445C03C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 aba55a521b1d4e2946b0fd9b4c577c531a1a7b618d01ad4f7aecf344c8cb39ba
MD5 6c3986b5c415c0ce613b9518a00dba4a
SHA1 cbbf6c864322c9b199e17b86076c578915bdd430
SHA512 2756f98b58bfb147f7a502a6a47ee1b48b6ac3aa0bc6709e7eae4b1819e7c8a4d1e6b1629e93696efeeab662f5ebae462e2414d6312a13f362c3b1e44d62a536
TLSH
T1B3E026244DCCC1BD611560D303388309C3F4784FE2C83E432F00D84CA18252AB2EA690
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13422341798828994

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13422341798828994
Size 16KB
SHA256 0d3d3935d39a8fcdb01bc644da41f457768776e21a3231cf31a4558f87254a05
MD5 af1d3dea63188ac23b81ffe0476d6506
SHA1 0c9422150a609baf643e5d5b62d9d30328dd4f9d
SHA512 d982987f53b088f887228327cf4c97ccbf1d562090d62b55fa668e31cb1ff8a692728406d568f46ef488981fcff32c92b6f2fd3e1b49853fe9af6bbbcc6b0755
SSDEEP 384:R1JCECiD9foL7E/yDslwk3rjo4zp0TMhzE:R1YEZD9fG7E/yDslwk3rj0T
TLSH
T17A72882D2AE5123EF3BAC678CBF551AFA832B9536251CE1D04E183051916F427DA3F2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 cd070dfdd222eed12c688a274ce7867afd6463823c8d9930ec64ac4cb83aadda
MD5 c726f08d7a28f892bfded2f4b513cc93
SHA1 cfb604da2f87042535d8b454bce48d91146a1ce2
SHA512 f794081716da0f4302ca332901e9570ca699631dd4aea00ae45055d8d0696d3cc0e7c992ff3f83be1b72dd8fbf9fba516ad52a2d06de90d7d8a708e71f950f2d
TLSH
T173B012A23700F955C0C40D7621C8CF425764F14100648087AC198E909DCB2F93F452E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 69847371c6c4e7014b2bd083868f87d94c585eac21f91c5765b476a2cca99c72
MD5 6cb96f64b70f9afc5e5e2165c471085d
SHA1 6c8ca3f52cae1af11bd224932a4ac03570f33d9c
SHA512 0c27730e7b82e365e023ff29652e117533332e9ccc0f95a5d64dbce0be70386899d89489fa1bb6de2b050f321aa8d89359dc55e0c0157e396e33565100ac7a74
TLSH
T1D7E0D8601ACEC63E614760DB4324D729C2F2B48AD6CD2B512B0CE48C6206150B3C7591
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 b37e0556021bb8b9186959a43816e26af723a61a20e7828620eac0ad7103fb2b
MD5 92c0f65fa9e2c32e3e719c51f92a953f
SHA1 ff97318c4673dbe9e0aec195480454bf97448b93
SHA512 57b0cd9992ab18daf2135c67b8d06c3623b04aca899f327b4249a5590b22ed95c3590f203d3952abf9a378d555e480bfc67adcbba8adc80c7b1aa733961587ae
TLSH
T1B9E086714ACDC63D6405A0C783759B1EC3F07C8A97C83B866B08D48DE501166F3EF995
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 991cbb121bf6018baab1675aefeb330f9040c7650332dbf8c1ba743b2495d5ab
MD5 4fbf49d8fe60930268c7c6ee200347a4
SHA1 7a8597c5b27bb4bd500aa117fa876e1bb0b8c35d
SHA512 04020b03c7477801dfb2b24e0c5eacf43e254258e989a0312d3b3f111fe62a477683c7281a3b3c04f8a3a4b8d4a8d80636d643ec89259c5e59c56d53014fa103
SSDEEP 24:KN387cXIbKDhq1qSKRryXbcXck2IRKUhE16SpydafNWHacdwMI44k+bIjyIKiLha:K0IIbKlqczylJIRKCEkKnIhK048ryz
TLSH
T11391EC91753A06813D3D249D85A4F82B5E8274673068AD3B37B828751F27E22DDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db-wal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal
Size 3.9MB
SHA256 c95afe6a6ae892439f2b171ac50ca68331ff073c868775a0f771c11e3ae6a9bf
MD5 c0e6d79bc42701302fcf2c1c6f36c7b8
SHA1 25b2682b748bb3dde44f7e3f7432eaa8df12ba57
SHA512 95c95d656434b2f395debb91d67dad9277080a8fb8db00bc350ffba3aa1c4a118f43a583d667ae039a6ca9b384693f50d264e50bfa9cc9c8c1c869c10f72c1e6
SSDEEP 49152:GAJEDMIeBlLg9FQAxqKwdH3Lj7TArNk2uBPlqlel3l0DeaIIgGxCjL6Bk3JTewoT:W
TLSH
T1A416DEF77D1981AEC9CD80B8958BEE4844B3422B9E24D5E5AA3D04C37B78B033D759C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79527353-ddd2-40b3-bf0d-1d286ae6e0b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\79527353-ddd2-40b3-bf0d-1d286ae6e0b5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 25592daa097f675f5eb5e91fab5cf42df6e9f3efcd19be87ac02902117d04574
MD5 e2684e83da3624ed78ed8d36f3f1110e
SHA1 e5728e813711f8306f859319a1c3038caee569aa
SHA512 46ff0036ec748b51d60f357362ef399117d85866f9b0e28ccea4114cdba675b35e409f5f6869bb4d132e32e82fa035105cd05192ef6625e4cd9584f6ca0a3637
SSDEEP 384:nOcXqn6sN0k+mInXqbMjJ4I234Q2j84+2md/DMIeJXCe00sV:s6MG234QaLlmdoxCuU
TLSH
T188826B36A8BCAC3A4DE3A585B44B3A135FF4926797C82F50D6EC5B0C01EA59C134F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6ffaded4ff36c285a6fd98c28db093318c10859d57157dc70f18773a22941830
MD5 b0563cd1691f86c897228e4d4d327f79
SHA1 24fff4cc1c66d774699d8f448a3777dc3a0d440d
SHA512 8b7f092dd664144082395a22bdb3c88b72d61bda9a4ab078474f430710e880c17560e4ba3fa544a24f2ce8d19e370ab678aebfbe5b2831f68dc60410a24a0a09
SSDEEP 384:njcXqnl3sNrkImInX2IIjJ4I234Q2j84+2Up/DMIeJXCe009Yx/7Ig3P:bl3oi234QaLlUpoxCuA
TLSH
T19D926C75A8BC6C764EE39A8AF65B3B037FF4516782C82E50D6EC4F0D1097A98134F522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9b6016568b599b13f36520c2222d4a8af52beb2292d9ddf70f4b0751d38bfef2
MD5 a432dc4c48d3210f07b0ba2ed38cdb75
SHA1 18bcbef58ede487fd6b37183748e6dae2eee2ed4
SHA512 3ea4e0ef472c4de058fb70842a835e2485c6aca6e02e527aec9d09004b0794f8c207f711f5429c5f48f8061172bb8b9bc978571c199c4bc9f2e0b79884266ed2
SSDEEP 384:nHiFscXqna3sN18TUNTUlIlkImInX2II6DfwwJ4I234Q2j84+2Op/DMIeJXCe00A:CFua3Uwgj4w234QaLlOpoxCuA
TLSH
T1ECB22976D8A8D97BADE38BC6B70A7A07AFF0126386C859D4DAD85E0C00875DD134BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 c6768e57a8470625441ce2ba8afb29b03658a50030e79b14b39ab19e035c16b9
MD5 195b393567088bb464d9a59dd929dcf8
SHA1 e33ec210e911449beb4584d6e17687c9cdf9c1ab
SHA512 7cfa5e214c085a37ad685eddd6dc1be803f25d17b7a565b216b6758d2ded0625dd23127434f41a7f91ab1448f64e67a5e8a798269f0d20d36b1086a61a142532
SSDEEP 384:nrcXqnrsN0k+mInXHxIjJ4I234Q2j84+2mm8J6fB9wk9p/DMIeJXCe00sV:zrVi234QaLlmmffB9TpoxCuU
TLSH
T1B0B24B7D9C689C3F48EFB749650E29271EA84237D2B85A68E3EC0B0CC07995CF346925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd89cf9e7de4ea33ef381969e645fbe6c0410a304f8fe2734aa56a8ff5171e62
MD5 2d041aa9bb5b393bb4c611f3b93aa516
SHA1 0bed4bff66b2f948fed7d8fc47e71b688fd69e17
SHA512 87ddce6f59a5e387e1b7aebcd1dff8d6aa92dd226172ad6aebb64172e8fd0c66fb10ba35c98f9fd9c572f1ce957089fba6f2b618209a339b798084709312440e
SSDEEP 96:WqONkzQsjpf63s5w5ih/cIPURHl8h4otop5nhBDBBJP1vXZ0J4Id/0LC04Sqk1AX:9ONT6s2QmiUyX3BoJ4I2L74Q2x4vS5U6
TLSH
T10702D735A878BC7B8EE3AD45B4873B276F98112BA6952F44D6D81F0C00DB69C2347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9000874e1c63f25c7097cd90e19c0ea4d7d595a03fa0e043431efc413609c555
MD5 fd7e6fcc92a710a6bf2efd1bdaaff2ec
SHA1 1baa610664f194dcc7bc6e0849ce554652b632f4
SHA512 bcbb476f91b36bc66a9afecb5b5b08bac0548a2bdf619df28aba8cdfc87a6493fe6287ac9739d9ad50430bffa382e2ade5a18b421f9d3c45ffeb86bc2dbda86d
SSDEEP 384:nrcXqnrsN0k+mInXHGIjJ4I234Q2j84+2mm8J6fB9wk9p/DMIeJXCe00sV:zr6i234QaLlmmffB9TpoxCuU
TLSH
T13EB24B7D9C789C3F48EFB749650E29271EA84237D2B85A68E3EC0B0CC07995CF346925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4b234016fac4df09df2d3e3fd8ebb27fbc2f7b19c8c858c0ea44afcd1dd70c66
MD5 5464b17b381341f963b47aa6ce572539
SHA1 a33715db4785a0106e8325ab052a38acc24ff9b9
SHA512 da02027558b86fc39537c112309ceb4137b642f65b73f2c27f582e3d7d24c38b8d356f98e135a38004b3601ac5afed9242acf597443607794082c62bddff8032
SSDEEP 384:nucXqnnsNrk+mInXoIIjJ4I234Q2j84+2Up/DMIeJXCe009Yx/7Ig3P:MnUi234QaLlUpoxCuA
TLSH
T19D926C75ACBC6C764EE39A8AF61B3B037FF4516782C82E50D6EC4F0D1097698134B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d53741b3709626d8698f4b757e485608a364c897c4d04401e3525462cee7bec6
MD5 519e7fa3423a31207435f87128c499a1
SHA1 7d00dc9630ca66eae7edc2ef9679a8189272c1e1
SHA512 e8030349d6c0d66dc5fda060eee2c38565990fbb94af37f9e67129ca2c9329e970f35af10296fc04e9d00b0eff8c7da7891f8127de3c548ccf39182dbf45446f
SSDEEP 384:nOcXqnrsN0k+mInXqbMjJ4I234Q2j84+2md/DMIeJXCe00sV:srMG234QaLlmdoxCuU
TLSH
T17F825C3698BCAC3A4DE39585B44B3A135FF4926797C82F50D6EC5B0C01EB59C134F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a4818013368de701dda8f3c0426b07125905af43c365d7400a96824225ebad72
MD5 83e924721a8182fe1d07d1e346c93151
SHA1 0948fd924301063cf709480f7a588f991c8c3c83
SHA512 0bd77a369ee0347df8f83cbc98a7f1a2d3862eec6c1fdc7281c83cb8a8733be9242bd3b6e8ada4d81abc6b4da1be9bd7d25a4ad9fbbd99d6690beba3a840e457
SSDEEP 192:CONt6srQmiUy13coJ4I2L74Q2j8PeN+2xc0yqNU6:CONt6aAcoJ4I234Q2j84+23dU6
TLSH
T1B612E936A878AC3B4EE3A855B4873A175EA98217A7C96F50D6DC1F0C01EF59C234F912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 547bc225c6ef222c0dc5cb85d7e5c6304217e5ee8f28eeea9a058d272d5001b4
MD5 481e7fb02c5726dff01e25fc4acb9a65
SHA1 60c338eb3a38520a46b6660e5d5b37657028d31b
SHA512 8f6e53da91c424b61ebcafa9d73a1fae18e7f3e2f4d0926f2023947048e566850d1c5431962c65da6dacac732696148f33a535ed2e29b851d93e00f7f93f8a3f
SSDEEP 384:nucXqnl3sNrkxmInXoIIjJ4I234Q2j84+2Up/DMIeJXCe009Yx/7Ig3P:Ml3Pi234QaLlUpoxCuA
TLSH
T129926C75ACBC6C764EE39A8AF65B2B037FF4516782C82E50D6EC4F0D1097698134F922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

campaign_history

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history
Size 20KB
SHA256 f0c68fbe081bd68c11c4fb4395a7b6a3473fd95918fd114185369662c0efab15
MD5 25070acd406e3b6bac6f91f04fd66980
SHA1 7afb55b09bd3a0ccfeaf27fe5e01bf767228fc01
SHA512 da2cd783ad643118b3a543da4059f2d1e7a27db0478561cad5e9437429cfce7cffb26580d861ab849a240915caea40350b4ebf6110298d38b6b10093f1121a7c
SSDEEP 12:TLyeSjPFUxOUDaaWZXiDiIF8izX4fhhdWeci2oesJa/Si3isuQQtydwKzbdraUx9:TLyT5UOl0afDdWec9sJ+pejB5fc
TLSH
T11A92DF276D352033E8DA873AF98349910EB8135EC9A7B848CDD049620DB1BC1A6995FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4d1c3ed288ab03356fc1064b548c3f5ad8e2443b6b3f0bb39e49e1726b4169a5
MD5 73db3323aab24a813f2d8cfd511dff65
SHA1 a43b795cb0fef7d60c73f817de65258ef61b0bf8
SHA512 3c6931582dd8318c403bd4d4d2f170be366b4623696a86c59843b86977daf248c435f7b8a2678d8a4d58f01287a9d8cd3897812c7339a28529b7136020326ffb
TLSH
T170410B587AFA1148B3B76F16AFF6A86D487A7C372E06D49D10050E4F4B62B40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9b894747f4959a798c3bf47bd2156103279c3eb9e55d47c6e84cfa840018b315
MD5 6998431d9eb1a55ca777d38256c0c3c6
SHA1 7a5505b17fd0dec7a950c657b71fdfc46e5bef22
SHA512 5ae8bed9cda29e3e5cc596d59dae6e4f5adc519181340ca9fcb3f5315bb9d582fcff1079e91bea09a933af986fdf8d4900e9b4b99f7ef2da40d7b3bb149f84ee
TLSH
T13C41D358BAFD1148B7B76F5AABF6A86D487A7C772A0694AD10110D4E0A62B40C861B33
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 471d60c9bc00f2d5e6bff49627cd5c5a7c710e44e937b54584348c475dcf7d6d
MD5 2f5704f30b4aa4bd0ccae79de4f757f8
SHA1 6b3078ec201ae7c8a8faee546505a1289991d946
SHA512 9467231969bbc0febb1fc591a580cd2628452432702b85e5520103dc40ebc3f1f2a34ffecbf06aed33e85bfd64cfbc375e6d424d7f18c24016ab70cf5c0ed8d6
TLSH
T12D512D586AE91118B3776F5A6FF678AE487FBC333A47D45D00110E4F0A26B00D8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

MSI5E77.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5E77.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a77cd879-77a6-4827-b730-e41f33b2eb3c.tmp

Path C:\Users\Admin\AppData\Local\Temp\a77cd879-77a6-4827-b730-e41f33b2eb3c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2840_1027105289\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 025184e9139d392f97322da1dadf96d2c5e0aa847ecd543185e4b90cc2bfe231
MD5 98fce4f946d17bad6aed46c1746c6dc2
SHA1 6644d709610f5effa247cee0d21bfadfb50eef68
SHA512 9c981fca900feecc93ad0d42b415624a70e039f9dec97b6f94142a1ab022efd999708d53bd747a82cf9a0398b75b049933262ea04328c8aae1caeef4ffc5cb8a
TLSH
T15CD0047057404130F71510F1C0D4CD050501CD5000C711141073100547450044513440
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 97c485393680e81685df1b2f371948417fd6dfe341393a2d1229c577b39d2259
MD5 02d06a7a71ab7c398e4ec41c943407a0
SHA1 41c57554e6c1ac38a9a7179972e7773e864b718f
SHA512 ea7d39e32440b60f92d49571ebbc6d3876bed7213138838b7b3c55a879698627cb1595346b17ea14204f6bb8a7ebdf35f04ae9ae131f2c2caeb52d3ae248728d
TLSH
T119D0123237414234F52020B38082A90D0801C61B408A4004643A951E5B080540E13881
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 620128953c2238e7fe8450c6e1b2bbd4cfd085308052d49ffe681af29d013d69
MD5 bc6f31a91f453620ce1dfbbf0ca1e5e4
SHA1 d2f47e9c877500cce3101b5dd8f46fd7341e5af5
SHA512 fba749ce925c9565ee777a19c7fc79ec1a38704ffd9410c5b7f51a5b1ff06fa16059ad611220bbc18d76d894cc8a5e6c7e71c8cbcd8eaad254ba3d2de38e7112
TLSH
T18D21CB1468D36A13DF340FF024F52FAA7B5DA4DE986C077F759055084847EC191A08E2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59237c.TMP

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59237c.TMP
Size 48B
SHA256 ca03c21ec03d36802611587f368df24d8410459c7a3febde49f10a11f4942fc4
MD5 23b334ae369ee78c643c20c5385847cd
SHA1 f213e36345a57043120d315adc01c372740a13f5
SHA512 519e7e32c367fc1e8effdd74402879ef28c543dfdac100541f9fcc3644aae51a0f1da2d4677588d7325f75cc01b5fcf5180822f2fd31146a135fd60faab217ff
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Network Persistent State
Size 601B
SHA256 d32989964a2168457fa7d3b026558bbc1a92a51d84421433532b33ea52c52b6d
MD5 0e14def9c19af5e3c0e70a5771862d34
SHA1 84fd20e8b0afb78b45f59afab0fc33e68f97964e
SHA512 e6fe86a98edc6f8095cc70c42c948b7f044f17575db1f8c39cb39bc80b283f535314c138811f440bb5bd21a5baec0fc3a0e0ddf7182d6e7f8a268f7defbc9b70
TLSH
T10CF0E1F2D6E495BE8E9716F81A24381BCA0E080806FC3D29C7E4EF978BD2539C11514F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59d43e.TMP

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Network Persistent State~RFe59d43e.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 ddd898b2ba2ec719d6e846997712b3621695627da9d6548a5a3603710592e19f
MD5 b3c3c635e2d89d310824bacba6b4f265
SHA1 b87311bb32749543912cb7499c27b615d1cfffca
SHA512 dd85a6bc367e0939053e528670a61a3c48cb419de7f9f614f578c83453cafaa5a75694237931e16178db0e70117f798d5ebc6c9a25ade6ff2497b73040de72e1
TLSH
T1ABC022A182ADA87350780623198C6D405E36F830548064F885E2C56A61A01668513013
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe592764.TMP

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\TransportSecurity~RFe592764.TMP
Size 188B
SHA256 7be1a5b7750e0da7b24c5816897ccef3426b396e32ebfe92ce25607d51c77775
MD5 04f50eb15b12b168fc4a273f5f777572
SHA1 9064b3d6420c9105f4b97655eb27b55f40f8a442
SHA512 5533146e1207dfe07897e3cef56239d098a94174df83478fb6af44ef0cac3377e5d8fe19ef454a848d2de8b79be1017953a29b7ca6df2b159984bcf86680f430
TLSH
T156C012A2846DF576207809B159886D465E77F534418964F896F28DAD61501666113012
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Preferences
Size 6KB
SHA256 4781ec711d6a8384c4aa5c59e889e584eb9e10152b0daae43b6397ed40c56680
MD5 df21402ce2d0d9e22186699e27a60505
SHA1 7c8873197c15062332b615941a54aba4ab6cead2
SHA512 4cd5b511e5c31e751bcdfdab8dbb3ccb1dec0b1a3691c4976003e987d89fc58f88bf0d9ac930790b921da24dc20de99d70bd0dc27d48f6daa5e7004c2ce0b745
SSDEEP 96:stn05i++M3dzb9Lfff9Z8i0vhETkU1m/7qx+WVHMSm+uecp7AjMdQjO+gSAem+MC:stn0Ubef9Z8paZ4/S+Wi77AodHUrm+MC
TLSH
T1ABE196039E2C69774CC7F2597A25FB12E2F6106262C50E58ABFDC70C09E66CD620B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59334b.TMP

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Preferences~RFe59334b.TMP
Size 6KB
SHA256 0e9328b5b806aaa2c76fbb9cdff60b9ef804d12067e967a848389088e893e7f3
MD5 4962ab0065232a457fe0f225b8904567
SHA1 710b64c7bcdb1bf59008972ced554e6d256d48ae
SHA512 b56aaa83c93570c24615763667dd0ade0d04ad6f4351f78599485d773289528040ee7134612030f555357d0f6ca858cbe6a8bb0a3bc3715bf8f3dd84e26a8d55
SSDEEP 96:stn05i++M3dzb9cfff9Z8i0vhETkU1m/7qx+WVHMSm+uecpRO1idQjO+gSm3vm+x:stn0UbFf9Z8paZ4/S+Wi7ROwdHUCm+M8
TLSH
T103D198035F6C657B4CC7F2197A35FB12D2F9106266D40E98ABFD861C08D56CD530B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 16KB
SHA256 bc82f8695c5a28ede2dd205cf4a7af3a76da9bbcc02b274b2356781816cec66c
MD5 aeddaace2b21e386d4f3e5641e6b95e5
SHA1 35f0ee159a67b5642191b0be3225590d4123c5c5
SHA512 94d7395778773d9138c6cc6e328787b35dba0303222e4b067b77e07c5c09d083a68a2b8e907d386485b06b6c64b417d418afbad25591d9ce1f90ca709e8fa101
SSDEEP 384:zYfTPLdSWCUkEaV8DNYi0qnSXaqZvENbl/8uZuy:4TRMUVai1SKqv8JT
TLSH
T15672BFB3AC3CD66B08EA9965F55B360BA9F59045C1D52F0DDDEE5F0D07C668C0316C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 1KB
SHA256 605b88bd072c2c457ef84c087f387b2fc7990ecd3e4c5a372dc653a5a73a88ef
MD5 fd5f718db2a1fa8ed8dc7872a15f61c3
SHA1 33407d5c91211cf00dacd5b8e8edfac82d44815c
SHA512 73e6a4511f6336c82ae3d5abc4b78023eb0839ec00b2cbc628368c83f417d3f6521cf963eade9b88ad271628ae1106975516c288726d81f58e52968551f87963
TLSH
T16531B5B3A5585737A8C26691B192FA4B2E621166D2A04E4862DE4F0802D758DA63FC32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 2KB
SHA256 c8c52edf6f5af048ac60e5bbef1ba6a86e931c92616e0a74ff8ebfe431000441
MD5 fec836ca7516709e93e1387d1765c7b5
SHA1 cf3a60355f71e04fe598de658c9c303783ec76bc
SHA512 cbe343b9df5d444ed20b2d676a23f3a10161f0a280e00e7dc6d40bfec0d54c44ccebe9a492dc3646212753286edfefc20d2299e2ead36d2b2bbe49fb507d9ae3
TLSH
T1BC51D873781C963789D36A94B98ABF03AE7211A296A11F9497DE0F0C01DB55D2307C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 16KB
SHA256 f43e1b5d100f049c6179673ecea362bfaf8735b5e0d1a0bca8046a532ac648ec
MD5 a35a7bdd5e12ad9d7b19df66f1e5f5ad
SHA1 1f99b78ffde0f4e5367ddeb588978e15d5c859f2
SHA512 e2593fcc2efb75156f13d9b0bf02d9af468fa596b5323809c71d63a2dce6ea4e1a5d2b111279727567ec30930212328b20ce3c7e5d28e8314024620ed5fc32a4
SSDEEP 384:zkfTPLdSWCUkEaV8DNYi0qnSXaqZv5Nbe/8uZuy:UTRMUVai1SKqvoJT
TLSH
T1C672CFB3AC3CD62B08EA9969F55B360BA9F99041C6D52F0DDDEE5F0D07C66880316C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 3KB
SHA256 11ddd3a00f144106edd437b099b460a9f75f90d87e7d3c7aac563699d8b67f31
MD5 7adeaa91c254c8d1c533ba2abfa9f0c0
SHA1 80e54ea0e67ff224204fb4457c80aea2153a6894
SHA512 c82ca4966aaa590efd2cd9aa6d307f4879c25f3b30758d0422ba0833b7675a444536135f9474354361159fb13cef20aaa97b770cb66fad46ee2d288c219be3cb
TLSH
T16971A6736968953B4DE3AA54B8CA7B07BBA21123E5D13F98C6ED0F0C01DB2982312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 16KB
SHA256 41b0a0b34e8257efaa8452f3825d3b65b57161295c979468d734bfa766d6612e
MD5 357e49edaef579640b701fd1a4bf7d85
SHA1 6768f4c00052ce7c4066100c760b729f4cd07b7f
SHA512 9017bf08dc8951c72cda9d95c4c1293a2bc460914b93be66bbf775a9802ee56dfea559e834606fb88d177e7600f067e108f9191882e2bc0734c3d96a3c9e07ac
SSDEEP 384:z3fTPLdSWCUkEaV8DNYi0qnSXaqZv5NbI/8uZuy:LTRMUVai1SKqv2JT
TLSH
T18C72BFB3AC3CD66B18EA9965F55B360BA9F99041C1D52F0DDDEE5F0D07C66C80316C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58bc08.TMP

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State~RFe58bc08.TMP
Size 1KB
SHA256 cfde67b5868b4f9b427817f22931507d6fe6a7f80993a5e21d0799b448b23a06
MD5 2c7320b4a8912bd1077bc978080f52f1
SHA1 4fd887e560f9e208dec2ce912c7d77b5a84b7e6d
SHA512 31e03abf93f5e2d462b96f1c252a0a82f4455d49f48d24cfa6f69809c40df6e76f1e8b4cbd2bcc10a447a1964faffeef337dc1f9ecca81ea43504a5a04b6ced1
TLSH
T14721B7B3C44C9637A4C25594B192FB8B3EA112A792704F0892DE4B0902C74DD973FC33
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

e58a563.msi

Path C:\Windows\Installer\e58a563.msi
Size 7.4MB
SHA256 77cd56844de4bc403b8b5fd921a295f639a932960665d31618f1395ffa6bd228
MD5 706c630a1461c1e2c42eae975a28b986
SHA1 9265d799175eeb39e4d842bf523eb5f127c96968
SHA512 822662a2e1d52508fd31abf9906ee7390ac289ff8864f4bc04b33f2b3228bd0b234a771a54b0796cfe988896c4e5c5dda38125519bae07b6d6862b0a41a50fd2
SSDEEP 196608:eZvzCsZWZNoCZR5kUS4m126mXHv8VKY2XH7112v:czPZONo6/kF4moXPCKBL112v
TLSH
T13676334B3E84A661D4A70D765875EB918F3DBC244B6489C32386B309EFF02D10FB65DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 4b878416c26fcec958f9d4be041a70683d1548683534db2090b1fdbbb9829642
MD5 c8ac4770b7ab5066303d0571e6e87451
SHA1 237ba036bda6ff28eaf2989ce0e82e06818dfa45
SHA512 d277c9f95d741feb4cac4c96c8d1bc1c75b070a248a07e505176bdf142bd23915a5dc04bccbb40118054348add2fd36ffd7f6a4d399a2e246594d5f239784295
SSDEEP 24576:WEpmg3M/doO/vvTLjSguqZWeY8Lx9Y/2MwYdGTMyclKD8GuAolzmVsBrjR:OY
TLSH
T1BE47A22436F92140E7B79E3DA8F0AA234D397D579C15DE8D05821B8E0921F71E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{64e9695a-364a-40b0-82b3-36efc228c7e7}_OnDiskSnapshotProp

Path \??\Volume{ac72d5fd-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{64e9695a-364a-40b0-82b3-36efc228c7e7}_OnDiskSnapshotProp
Size 6KB
SHA256 600e2d80929062eed22bbfb298f64ad4c27adb493ccc6a75797189ff7943b30a
MD5 3d59ee03371a899a8e19c7e19f14ad7a
SHA1 0d8c23ecd2a20d1843cb0f24dba174d72bc8f65b
SHA512 04a10f20b933424acd2e858170e2bc919219a2e43ae6596e5b7c4e96a84d776d418e4f041e3723f11016e0c24983db73712f67331ce372d09690ef91f0f97581
SSDEEP 96:FziDxUvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:AQb++ZVmN
TLSH
T1C0D1AA084AF54311E2B3AB3128F54557A437B811FF33CB8E0198638E6670A10F875F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-48-0x000001DF0A610000-0x000001DF0A689000-memory.dmp

Download

memory/696-4-0x000001DF0A610000-0x000001DF0A689000-memory.dmp

Download

memory/1420-84-0x00007FFDA2730000-0x00007FFDA2731000-memory.dmp

Download

memory/1420-913-0x000001BDB4380000-0x000001BDB4420000-memory.dmp

Download

memory/3832-85-0x00007FFDA25F0000-0x00007FFDA25F1000-memory.dmp

Download

memory/3832-86-0x00007FFDA3300000-0x00007FFDA3301000-memory.dmp

Download

memory/4016-88-0x000001BF1C7B0000-0x000001BF1C829000-memory.dmp

Download

memory/4016-5-0x000001BF1C7B0000-0x000001BF1C829000-memory.dmp

Download

memory/4132-637-0x000002378FBA0000-0x000002378FBAC000-memory.dmp

Download

memory/4132-638-0x0000023793270000-0x0000023793299000-memory.dmp

Download

memory/4132-639-0x00000237932A0000-0x00000237932DB000-memory.dmp

Download

memory/4132-636-0x000002378FB60000-0x000002378FB8E000-memory.dmp

Download

memory/4328-76-0x00007FFDA2730000-0x00007FFDA2731000-memory.dmp

Download

memory/4328-912-0x0000015914410000-0x00000159144B0000-memory.dmp

Download