hxxps://gltnub[.]live/d/IObit-Malware-Fighter

Analysis

user interaction
yes
max time kernel
119s
max time network
117s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
11/05/2026, 02:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gltnub.live/d/IObit-Malware-Fighter
Sample260511-c2cktsav2y

Score

7^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4432	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
4432	setup.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_572482976\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1701422069\deny_full_domains.list	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_572482976\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_788158160\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1701422069\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1701422069\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\sr\messages.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4656_2065809443\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_788158160\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_788158160\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_1701422069\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_788158160\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_572482976\LICENSE	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4656_450247847\_locales\si\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5216	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229404649332145"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-262299150-3324607021-1566776428-1000\{209F6D87-6374-4FBA-B873-9493B1A1F0F4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-262299150-3324607021-1566776428-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4432	setup.exe
4432	setup.exe
4432	setup.exe
4432	setup.exe
4432	setup.exe
4432	setup.exe
4432	setup.exe
4432	setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	6116	7zG.exe
Token: 35	6116	7zG.exe
Token: SeSecurityPrivilege	6116	7zG.exe
Token: SeSecurityPrivilege	6116	7zG.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
6116	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1268	4656	msedge.exe	82
PID 4656 wrote to memory of 5216	4656	msedge.exe	84
PID 4656 wrote to memory of 4784	4656	msedge.exe	85
PID 4656 wrote to memory of 4784	4656	msedge.exe	85
PID 4656 wrote to memory of 4784	4656	msedge.exe	85
PID 4656 wrote to memory of 4864	4656	msedge.exe	86
PID 4656 wrote to memory of 4864	4656	msedge.exe	86
PID 4656 wrote to memory of 2340	4656	msedge.exe	87
PID 4656 wrote to memory of 1652	4656	msedge.exe	88
PID 4656 wrote to memory of 2340	4656	msedge.exe	87
PID 4656 wrote to memory of 2340	4656	msedge.exe	87
PID 4656 wrote to memory of 1652	4656	msedge.exe	88
PID 4656 wrote to memory of 1652	4656	msedge.exe	88
PID 4656 wrote to memory of 3384	4656	msedge.exe	91
PID 4656 wrote to memory of 5336	4656	msedge.exe	92
PID 4656 wrote to memory of 3384	4656	msedge.exe	91
PID 4656 wrote to memory of 5336	4656	msedge.exe	92
PID 4656 wrote to memory of 4804	4656	msedge.exe	93
PID 4656 wrote to memory of 4804	4656	msedge.exe	93
PID 4656 wrote to memory of 4804	4656	msedge.exe	93
PID 4656 wrote to memory of 4900	4656	msedge.exe	94
PID 4656 wrote to memory of 4900	4656	msedge.exe	94
PID 4656 wrote to memory of 3420	4656	msedge.exe	96
PID 4656 wrote to memory of 3644	4656	msedge.exe	97
PID 4656 wrote to memory of 4704	4656	msedge.exe	100
PID 4656 wrote to memory of 4704	4656	msedge.exe	100
PID 4656 wrote to memory of 4704	4656	msedge.exe	100
PID 4656 wrote to memory of 6004	4656	msedge.exe	120
PID 4656 wrote to memory of 5672	4656	msedge.exe	121
PID 4656 wrote to memory of 2532	4656	msedge.exe	122
PID 4656 wrote to memory of 1748	4656	msedge.exe	123
PID 4656 wrote to memory of 1748	4656	msedge.exe	123
PID 4656 wrote to memory of 3528	4656	msedge.exe	124
PID 4656 wrote to memory of 3528	4656	msedge.exe	124
PID 4656 wrote to memory of 4148	4656	msedge.exe	130
PID 4656 wrote to memory of 4148	4656	msedge.exe	130
PID 4656 wrote to memory of 5348	4656	msedge.exe	132
PID 4656 wrote to memory of 5348	4656	msedge.exe	132
PID 4656 wrote to memory of 4492	4656	msedge.exe	133
PID 4656 wrote to memory of 4492	4656	msedge.exe	133
PID 4656 wrote to memory of 3368	4656	msedge.exe	134
PID 4656 wrote to memory of 3368	4656	msedge.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gltnub.live/d/IObit-Malware-Fighter
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff83a10c188,0x7ff83a10c194,0x7ff83a10c1a0
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,7847208454404457038,6357789240498335356,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,1918231366126950769,7076714236348069042,262144 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,9442020144402400462,4720606537355151546,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9970377236652319162,17265194855549743023,2097152 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,16851382562591680592,17764687096432892438,2097152 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,4428293909754535231,472922551882159968,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,4800663254922824671,1766479769250748133,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5644,i,6535399039430552860,10631498644099352286,2097152 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,8452736732108722904,7101317061247816461,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,14482589341225057946,14908743913156343940,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,14482589341225057946,14908743913156343940,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,4561858394527622928,13505747771623742222,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6740,i,7590960173841882091,11908919810315705826,2097152 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,3838539189991565847,13906581665276951607,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,6920722418356577943,4299608813483792944,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,1754170819514219147,17900704011937088390,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,7187812627515929675,5146223614184960183,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,13135347361704518978,9754720091631541653,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,15470419992267650251,7987214001912254325,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,14480203914425296638,8222017566604731120,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,16015319389382602474,15093814570732617836,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,2298170887117381256,9660251434233133794,524288 --field-trial-handle=2468,i,2242764289587760529,18006260738381912670,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4264

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3120

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\setup_x64\" -spe -an -ai#7zMap703:80:7zEvent11510
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6116

C:\Users\Admin\Downloads\setup_x64\setup.exe
"C:\Users\Admin\Downloads\setup_x64\setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4432

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:112

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ce3de864fc029de1185f15a333c36ccc857bab064d704c1c9cb74f2d49559c6
MD5 95e4fa06728773c204126766fa6a3f91
SHA1 b2b2ff6dd17d9d1fca4c1aa1d226d00b195749be
SHA512 11564019829fb23fd1b38faa2fb3c3298ba02394920b54be1169d3ca923ae73304fcdfa9ca88adaeddf4fa314022ecd93085a2ea4ef7973e86e12e5d7e562c19
TLSH
T10ED0806C17B17C31E099967015C57B05656DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0dd682e82aa8cd6159af27b9fe9796b85ae32d8c3b7a54ca83c08e7258a7175
MD5 2ed58da04906706bb0da862e8e7185b5
SHA1 3c5218714f1830b95877032ae59a91505796d0f3
SHA512 c1694efeb33c2b30e89769d925a4ac7923301aa37e527971ebc442ad3c0800bfdbcade111c6abe3c94cf362ebe4febbfe65aa0c3ad7f46f25d381ebed28c5a41
TLSH
T197D0806817B17C31E085967015C57B05767DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 54b0d336f615cb1bf6e54e5df98b27d19692faada9721341e3b0b78ab34ff7dd
MD5 9e293efc013d6cc6b7f62286b216b2a0
SHA1 d3a57912d571789778be5b770824d6f2459163f7
SHA512 399aa5fad9ec1f02049b7f75855f493c523dffc882b76b058a3e142aff6317e970aab59297afba26531fbd9a89ba24ae272417b28118595fe68db76f135b16a5
TLSH
T1C1E02BAACC269C3709FE075961505A51EE91131B2B51894F3E3D81098FB063645D9C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 38de7a243f7e33e2789c5d1c05b8e939b89b30256509eeda6652f9bcf9a6f846
MD5 7c5a58d0b69d985f3f2fbc351a274928
SHA1 cac14ffdb8316a83a7a944e47468a23f0bf192af
SHA512 481192b9ca3012483ac1b0ae5dbf15517194b0bd85605e057a86f51aeb0a75f10b4f619311fe04dd99cc52bb1881f464801c607fafa190f57a0bc1455de823fe
SSDEEP 96:nkzJZXafh/IU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfd:nSJZKpf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T12B14445F5F352322CD7D917668EB44A35D7DF03F8B5366CA286104B4CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 abc1d907c48055ae0003d3decc76421d227131531d108d3fd76d476224bd5ab9
MD5 212844ae4e887a5d73165134874824cf
SHA1 10e38c395288c68718866ceedadaca7e6334eea7
SHA512 bc2273db82eb0a9ad6370a777eec735584b63f15fbd4f5791b53ff145f8d5da06cda75d017f70f112cd78f20ab23d349f85370858c08a4556f351dd73511e76b
SSDEEP 24:TL68LbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T2SLopFMatSaw/auUOt8B
TLSH
T171928C4E5F346220C0F04B36EDD185672F7C211CD3A72A99DE5410F3DE9259BF1155AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9f7962a7e6dc19f6b5e48592e837039de4afeefb91ca7481029b6e587edbf32d
MD5 3cfd25d591b476331577bb904660b653
SHA1 2ba04ed2e1ef654fee930177f45eb86d7590addf
SHA512 969e727e2e4505142445881e46191951e4786b0ca7a715ee68b584126e7a641795061f0b7b38a4061d3baf96dc82240aa5d7b52870c32b401c75d3244cfa1974
TLSH
T10F519FF783E4856D8A1196F0BA187E2FCE2D0914432C3D5AC9E4AF5B93E3470E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 de2e18a10ff97eaf363f232ab7f89d70aa7ff26c7a98d9f9ef71a51bf229912d
MD5 918d96cce96619b868bfbd00c54116a4
SHA1 b62275b11d5ad57a4af44867c429eebed64037c8
SHA512 1d22a8a71a73a38834bf6f7f5caf0deaec553e233db1ba102730581f8c0ff7f4e35855113f0e8f4810d4444f83ed1d315b69fd2a0728a2b3686a1008b9bbd4f2
SSDEEP 192:sxZabREyMqZ/K1Ml8M9aG/f64s2S4x+kHC4dMzodpLHW6+WNGYLVprq3IgjsJ:sxZqf1l/fhs2S4ZHC4dLHbGkyjQ
TLSH
T1F162D715AA385937CCDBD209FA457F53D7F9152392944E84AAFCCA0C04E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f05a1cfba8ce7f9176142c5b5dd93bf41662facc114829864670ecbdf256e952
MD5 99691f5e042ccfa7532e039b237c28c2
SHA1 03535566f3a561708afcd9aee9666c25adcaf8f8
SHA512 3f0ec4878566a5f0dc59d40f4639ce1f80c789554987d433b08b0077f555df7a9aa15593d54a821b317a7b904528d3e19a43e8ba9739d2883d43a75b2218a437
SSDEEP 768:z0sjWCv7pLuL/OmWvOKxC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+j+xLlx72BUroU:z0sjWCpE/OmWvOKxCu1jarj+xLjyB/K/
TLSH
T13FF2FA3B780CCB7F4F805E9CDC2A7E8E6DE8018B9698895447FA844C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 104b2f57ff2765d3a6918b785f9c80a16bc781ee1665d823c8b27d25db54973b
MD5 d15f4adaea0ca3acfbadccb93428e35f
SHA1 423f07d9dc73d12ca5b11cec85860cd56ad2be99
SHA512 4d2c3727d2644d813492c2415ba8bf99fdba9a53f126f618c8200a7df6109462b36d36b2d40e2bc40593b9946a4604afec3d5d9f065dee873c46bc4059d8cafa
SSDEEP 96:KY5OKiwSKWkYKR2yCyMKLC4NiKWU6ezWKYMboAKt+6Ob2KwMnZWKSQiOzqKUEzza:0BKLfyFpHbxpBJhZf4f7Kn3Uv5jm
TLSH
T10DB20610313A42913A7EB9CA81E5B41E52C335B37019E92B7BB944A64F67E21CDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 f14c3d949a8c6ec11e2e539ae47987595ee88117853d0b22a5a8e1d7f746ed3b
MD5 372f2df6601a805a43374199beaa0940
SHA1 c6a0df8e95d246e5cea02d555b442d4c79ed1c2e
SHA512 6e8cee9f329ea7eeb302811e43cfd8e5efc05936ff73b55e5eb84f3c20d3f8fa1579db606e934c672ae29ec796b8c92159268506abb17d3c6d4f93ebf26f510a
SSDEEP 192:P+xWiIdPfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mxAfQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T14524620A7B747001EDE6D9721CB080771E3CB16ECF22A6D15DA654698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7d1fea7b081285c3d3e47d6f6ffa09f3059e989dc80a429843a7dbac2818a940
MD5 b4008fdae257a400ccffad86cf772891
SHA1 735bed134daf5f5fa819c2338de485cc09a48e9c
SHA512 fa28db99bcf218f00506e645bb2368f33bb05b405a454f3f622f8acb3631ebc5cddd77669777f952b161e56bb09a0ff9f39c5f8db2c444c0fdb6e883235fe628
SSDEEP 384:ndqiFjCcmyWCdhsNf8TUNTUlI4ATHmbPN4570l4fFYh3rgHQsgGEWyhkP+lFYS/m:dhF2cpLEwg7HNnYZrgZEWyhkoFYS/EwO
TLSH
T181D24A31F8A8CAA7EDEA4BD6F75A3643EEE04163858C99D4D9D91E0D00EB09D530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9b4cdb327fb2a0ee5566c3e61bf3b74fb38834cac40290b9da3b21ecb5b3c58c
MD5 3a280461e59aa935eda81c8a7fd63918
SHA1 acca90f1894c34bc56da875c9ea4a6b92397a1e7
SHA512 77ae9af3e2d54f117f2771dff3bcae2dabdd5d785dcfe4b3c0f43464a5cbbf9dabc2e62b71645711a47fbd267f836e0632da5fcf035fb407253a716324676396
SSDEEP 384:np+iFavqMg3sN18TUNTUlImkrbPNmlcl4fFYh3rgHQsgsTRYV/Vw1mR5rCe0RrNB:pVFayv3uwgAvYZrgLTRYk1mX/0lL
TLSH
T1F1C24A36EC58DAABEDEB4FC5E7493A03EEE04167D98C4AC4D6D81E0D00A709E9307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 be4793574fc440827b1a599e3830cff928beddcdabc27ac4efd50ed1d7954084
MD5 0de94751e85e7f2cbf87eb399cf2d24b
SHA1 5c1c4dce57f74e10d38c3354583f7000e6cf05c7
SHA512 d36f5ba9f3bbcef200085f3221060a56fff60678a55539cb44163f75e7f6ac03ea1ecbcd0fba90b83667fd80bea50c9e726d34bbc201ba4b0f25655b5a1dedaf
SSDEEP 384:n6+iFavqM53sNf8TUNTUlI4k2fPxbPNn570l4fFYh3rgHQsgGfWy5rN1k+5vI+d:6VFay63EwgSfPdnYZrgZfWy9x
TLSH
T1DEB23A31E868CA67EDEB8FD6E71A3603EEE04197C98C4AD4D5D82E0D00A75DE530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a64981ed78e7dd12f0628072affcfef56f7acaaaf68941ad6d7e4f08af9a1a23
MD5 aee88e5137e9c220e2bdd14b4322eba7
SHA1 8a17b3aba1a4e9b16c4b0b8440a9d1491b57a503
SHA512 e859da3fce9d272be3963b80d0d9c9b7ae0952e5b956a855f20c85a7c9dfd5318f062eee17586f2254161ff55b377eebc5cc8c1489a9ceca3827347ef8858fea
SSDEEP 384:nd+iFjCcmyWCusNf8TUNTUlI4ATHmbPN4570l4fFYh3rgHQsgGwWyhkP+lFYS/Ed:dVF2cpuEwg7HNnYZrgZwWyhkoFYS/EwO
TLSH
T157C24A31F898CAA7EDEB4BD5E75A3643EEE04163858C99D4C9D92E1D00EB0DE530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7bc940294b28dce6e0d42bef4af97e1b5f950cad6dd6a35d43b687d8d0753f0a
MD5 0d0be5c0de187e2d037ba6dc48f76212
SHA1 7602f162f664d1094db86254f2ab65a5d0b8226e
SHA512 3717959f0467416363db3f7202a84237c23bac4db487ea3c8ea1ad11ad6c0b4ddec20975f69786b0b47635419c7ca207a598758c877389501d890cf7365df49d
SSDEEP 384:n8+iFavqMg3sND8TUNTUlImkrbPNBIBl4fFYh3rgHQsgG8WyRYV/Vw1mR5rCe0RH:8VFayv3UwgqiYZrgZ8WyRYk1mX/0lL
TLSH
T11DC24B36E854DAABEDEB4BD5E74A3603DEE05167C98C4AD4DAD81E0D00E709E530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d37ee626b24acb4bdda843ef55b358ef5001ae639acd64ca999d73d51d72fc13
MD5 eab535a6cda916d7bc01d412dd5f080c
SHA1 31a0b35a6726089bc15b0dca1cbb5e7ccceac5b7
SHA512 0f09b4683c6976b00330e579bdb3670e047b589a84af9931d0c3f03bb84696b8ad788a250bf7bcc47bbe17a2db4839e7422defedfe7a6bc73b1e004897ec1d41
SSDEEP 384:n6+iFjCcmyWCusNf8TUNTUlI4ATHmbPN4570l4fFYh3rgHQsgGwWyhkP+lFYS/Ed:6VF2cpuEwg7HNnYZrgZwWyhkoFYS/EwO
TLSH
T1D8C25A31F898CAA7EDEB4BD5E75A3643EEE04163858C99D4C9D92E1D00EB0DE530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a8a77b8212fc9eb9a7a79f0e1f41c98107918d9dbe7adfacc3bb6e5aff920db9
MD5 e6d720fc8dff531b78f6322db1c69447
SHA1 027e8a39a44155b5dbb7706aabaa308616231313
SHA512 788ae4aae5c56c65f98b9f1ea9216f3108809e012e8756c2059db04fdd8c8fd9d1a23e0c0e52a1285f9da0f330e26bac6042aa2fe3effbae67d273cd67f0032d
TLSH
T14F4151E04C3E2AD1D4BD0A3E748B78FCD5DCCB2AF5A4347D6824DA880A3A50D248543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cc28f07e6d32097dc6cd81a99dfbafe990d96fa15496c5c711a9c8bea812e09f
MD5 c6865a07d3999a679399e0f94eaa475f
SHA1 e9364aede45831be90241fee0dfb1bf975f6f995
SHA512 5185d7d3818ee43befab04f093e217a46c218c22eecbb177880199b5156f64b9eed7bebf9d6780cf42c5f27658d9a5b780ed6c03b54621ce0ed6206fd47dca23
TLSH
T1D24140E04C3D2AD1D4BD0A7E709B78FCD5DCC72AF9A4357D6824DA884A3A61D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9f724b073e6c5cfa71d66bad1fa8be62513784278cf7512d3432535fe433acfe
MD5 5662b7bf3a6af05ec9ed45712e928abb
SHA1 6183ad8b90181bdcff2dc2746f9cd0b724263138
SHA512 f001c7ddce25f0d504ce701c1d5b4e9729a581c48888474946efae4fac877e41437056463be2d36cc9adff78770dd15d00c050b07f9e188ed3e133134c21afa1
TLSH
T1D4414FE14C3E26D2D8BC0A3E708B78FC95D8C72AF4A4357D6824EA88463A51E644543F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0b17397294cc84de02f3284ca5099c520d072cb03963c5a462f946c76e3fc75b
MD5 acd570cfae5f907150afcb266697b445
SHA1 41808bc745674bedb1bccdfd692234ab79f4a7cf
SHA512 6918c997fc5358400587ecacd3662efcc631d3ac88becf9087910ef767435ae35b759785f1980fab3642a6214aedaff92e856d3b582ec3493f27bdbd36c9215e
TLSH
T1E3410798A6E91148B3B76F569FF6A86D887EB8772F0BC45E00110D8F0A62A40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

setup_x64.rar.crdownload

Path C:\Users\Admin\Downloads\setup_x64.rar.crdownload
Size 13.4MB
SHA256 19c5c4b03e0bca14352c41e750e95ebf377d329ddb50054ececd245b878ede2c
MD5 c15e2d64d5a3a6c27797e09b748431b8
SHA1 ca6db7a428e3011946c7298b6d91ed7c8e7f9336
SHA512 92b2bf1a5e53502acfdb423468b3fe587236fdad1bcebf7da1f3375a2f3f58fbd7b950f6688a7446ae6a9d782fa95b6c9871e088749d10540323e08817b25723
SSDEEP 393216:BvjYtsWwdrlb2PBh3JwhOjGFBFM2zL8xAgt:BvTW+I5whksq2zL8+g
TLSH
T1EDE63342C407492E7AF1D72BB6B4C42B452A962B335951DC842F6C3EBD467C4ED8FE0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpclient.dll

Path C:\Users\Admin\Downloads\setup_x64\mpclient.dll
Size 2.1MB
SHA256 8dbbc29ab57bb1d0887053586d3c187ee91675d98690280a37677f3c311fd596
MD5 19988acf6407f00f32261e59c56ad97c
SHA1 233577183af0da7bd8ad978fef98928c2ef847ec
SHA512 0aaa6c3fab2d7b889075de71b8452033298ccc27bb2172593263d7dfbd2bdf5e9b916f96f910080a804fea936c329736324f6a588401100d4675f4a30b08c9b3
SSDEEP 24576:rUhrBOxOVrKKzCTSOlbo9S6CtJWoizvUCbEiIxhFheletn92gOw3kwRh:rUh9kGGSCTSOlbolpbxbEF3tfRh
TLSH
T111A56D477DD0847AC09A733199F622957738F8080B3627D32E61AE7A3E76BD05C7A748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\Downloads\setup_x64\setup.exe
Size 683KB
SHA256 715b4174065916a6412f60b3c10664b323dc737fd717ab09627083be34626fe0
MD5 6669e10c960f6c2297bcd3d5a27412aa
SHA1 73bee544b24312d0057d9ce5e62daa9f73243d00
SHA512 feb1e93aed3f1a0ade6e6ab169af46ddd438aa80f6667fb24421d2f0b7da1c4a4902438421079a75eecfc9a3347c3ebe7f62b88ea9e67a9c951954d8555ea497
SSDEEP 12288:tiGbyLR32C4NHhZoLCZcvDaLgf5pB6Nwi5//E7soazN0uahRg:MGboR3P4NHboLCevWLGL6//E7sTN0hhC
TLSH
T1ECE48E2AB3E401F9D1B7D276C9535A26FB71780A1731CBCF03A046562F276A49E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4236-574-0x00000000034A0000-0x00000000034A7000-memory.dmp

Download

memory/4432-609-0x00007FF819730000-0x00007FF819982000-memory.dmp

Download

memory/4432-575-0x00007FF819730000-0x00007FF819982000-memory.dmp

Download