a764a716cb48a3cf738d63034069aaff3a2fd198bea15587824bb572eecb7fc5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 13:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WebshareProxyGenerator.exe
Size 28.8MB
Sample260524-qk2ehsdt8j
SHA256 a764a716cb48a3cf738d63034069aaff3a2fd198bea15587824bb572eecb7fc5
MD5 5dce82f162ce2c86c3df33a83da5acec
SHA1 1ab062c5105d822b560e32fea311682727c042b8
SHA512 961461f327a762d42be8add433722bdb10fbb62a142de022fe68060c27bd61da6184e805e742462ffb37c730bc38797696cf00410bb1b50958767c50de2835d8
SSDEEP 196608:YFL/LyBEqoA3cZSQcX8bdvCIwHliaiZV5u:Yx21sZSr8VCIwHK
TLSH
T1F0674C23F8A15994D4EAC170D672412BBAA13C690B7413E72690F3241F3BBD0FEB6B55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5316	netsh.exe

Executes dropped EXE 5 IoCs

pid	Process
1496	Setup.exe
4084	coreinitx64.exe
2000	WebshareProxyGenerator .exe
4860	coreinitx64.exe
4472	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\coreinitx64.exe\""	coreinitx64.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	coreinitx64.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	coreinitx64.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WebshareProxyGenerator .exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4472 set thread context of 4596	4472	explorer.exe	121

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1984_190964491\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1428320235\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1984_190964491\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1984_298555382\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_646952616\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-nl.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_646952616\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1984_501034526\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1428320235\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_646952616\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1984_298555382\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1428320235\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-cy.hyb	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4752	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241024326566252"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{72EFA2BE-92A6-4202-B99D-111D7BC5FC55}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4472	explorer.exe
4472	explorer.exe
5176	msedgewebview2.exe
5176	msedgewebview2.exe
5360	msedge.exe
5360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4000	msedgewebview2.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	Setup.exe
Token: SeDebugPrivilege	4084	coreinitx64.exe
Token: SeDebugPrivilege	4860	coreinitx64.exe
Token: SeDebugPrivilege	4472	explorer.exe
Token: SeDebugPrivilege	4596	RegAsm.exe
Token: 33	4596	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4596	RegAsm.exe
Token: 33	4596	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4596	RegAsm.exe
Token: 33	4596	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4596	RegAsm.exe
Token: 33	4596	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4596	RegAsm.exe
Token: 33	4596	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4596	RegAsm.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 1496	3984	WebshareProxyGenerator.exe	81
PID 1496 wrote to memory of 4084	1496	Setup.exe	82
PID 3984 wrote to memory of 2000	3984	WebshareProxyGenerator.exe	84
PID 4084 wrote to memory of 4472	4084	coreinitx64.exe	86
PID 2000 wrote to memory of 4000	2000	WebshareProxyGenerator .exe	87
PID 4000 wrote to memory of 4072	4000	msedgewebview2.exe	88
PID 4000 wrote to memory of 2212	4000	msedgewebview2.exe	89
PID 4000 wrote to memory of 2212	4000	msedgewebview2.exe	89
PID 4000 wrote to memory of 2212	4000	msedgewebview2.exe	89
PID 4000 wrote to memory of 4960	4000	msedgewebview2.exe	90
PID 4000 wrote to memory of 3576	4000	msedgewebview2.exe	91
PID 4000 wrote to memory of 3576	4000	msedgewebview2.exe	91
PID 4000 wrote to memory of 2588	4000	msedgewebview2.exe	92
PID 4000 wrote to memory of 2588	4000	msedgewebview2.exe	92
PID 4000 wrote to memory of 2588	4000	msedgewebview2.exe	92
PID 2000 wrote to memory of 1984	2000	WebshareProxyGenerator .exe	93
PID 1984 wrote to memory of 2012	1984	msedge.exe	94
PID 1984 wrote to memory of 4752	1984	msedge.exe	97
PID 1984 wrote to memory of 5088	1984	msedge.exe	98
PID 1984 wrote to memory of 5088	1984	msedge.exe	98
PID 1984 wrote to memory of 5088	1984	msedge.exe	98
PID 1984 wrote to memory of 3624	1984	msedge.exe	99
PID 1984 wrote to memory of 3528	1984	msedge.exe	122
PID 1984 wrote to memory of 1660	1984	msedge.exe	101
PID 1984 wrote to memory of 3600	1984	msedge.exe	102
PID 1984 wrote to memory of 4880	1984	msedge.exe	104
PID 1984 wrote to memory of 3648	1984	msedge.exe	103
PID 1984 wrote to memory of 4476	1984	msedge.exe	105
PID 1984 wrote to memory of 3624	1984	msedge.exe	99
PID 1984 wrote to memory of 3624	1984	msedge.exe	99
PID 1984 wrote to memory of 3528	1984	msedge.exe	122
PID 1984 wrote to memory of 3528	1984	msedge.exe	122
PID 1984 wrote to memory of 1660	1984	msedge.exe	101
PID 1984 wrote to memory of 1660	1984	msedge.exe	101
PID 1984 wrote to memory of 3600	1984	msedge.exe	102
PID 1984 wrote to memory of 3600	1984	msedge.exe	102
PID 1984 wrote to memory of 4880	1984	msedge.exe	104
PID 1984 wrote to memory of 4880	1984	msedge.exe	104
PID 1984 wrote to memory of 3648	1984	msedge.exe	103
PID 1984 wrote to memory of 4476	1984	msedge.exe	105
PID 1984 wrote to memory of 4476	1984	msedge.exe	105
PID 1984 wrote to memory of 2640	1984	msedge.exe	106
PID 1984 wrote to memory of 2640	1984	msedge.exe	106
PID 1984 wrote to memory of 668	1984	msedge.exe	108
PID 1984 wrote to memory of 668	1984	msedge.exe	108
PID 1984 wrote to memory of 4756	1984	msedge.exe	109
PID 1984 wrote to memory of 4756	1984	msedge.exe	109
PID 1984 wrote to memory of 4756	1984	msedge.exe	109
PID 1984 wrote to memory of 5368	1984	msedge.exe	110
PID 1984 wrote to memory of 5376	1984	msedge.exe	111
PID 1984 wrote to memory of 5368	1984	msedge.exe	110
PID 1984 wrote to memory of 5376	1984	msedge.exe	111
PID 1984 wrote to memory of 5816	1984	msedge.exe	113
PID 1984 wrote to memory of 5844	1984	msedge.exe	114
PID 5844 wrote to memory of 5980	5844	msedge.exe	115
PID 1984 wrote to memory of 5284	1984	msedge.exe	116
PID 1984 wrote to memory of 5284	1984	msedge.exe	116
PID 1984 wrote to memory of 5524	1984	msedge.exe	117
PID 1984 wrote to memory of 5524	1984	msedge.exe	117
PID 1984 wrote to memory of 5476	1984	msedge.exe	118
PID 1984 wrote to memory of 5476	1984	msedge.exe	118
PID 1984 wrote to memory of 5552	1984	msedge.exe	119
PID 1984 wrote to memory of 5552	1984	msedge.exe	119
PID 4472 wrote to memory of 808	4472	explorer.exe	120

C:\Users\Admin\AppData\Local\Temp\WebshareProxyGenerator.exe
"C:\Users\Admin\AppData\Local\Temp\WebshareProxyGenerator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\coreinitx64.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\coreinitx64.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:808
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4596
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "RegAsm.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:5316
- C:\Users\Admin\AppData\Local\Temp\WebshareProxyGenerator .exe
  "C:\Users\Admin\AppData\Local\Temp\WebshareProxyGenerator .exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="WebshareProxyGenerator .exe" --webview-exe-version=2.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=2000.5040.235209453338747117
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff8d215b078,0x7ff8d215b084,0x7ff8d215b090
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView" --webview-exe-name="WebshareProxyGenerator .exe" --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,1175228883555660517,2700246793567650065,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:2
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView" --webview-exe-name="WebshareProxyGenerator .exe" --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2020,i,1175228883555660517,2700246793567650065,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView" --webview-exe-name="WebshareProxyGenerator .exe" --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1700,i,1175228883555660517,2700246793567650065,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:13
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView" --webview-exe-name="WebshareProxyGenerator .exe" --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3632,i,1175228883555660517,2700246793567650065,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView" --webview-exe-name="WebshareProxyGenerator .exe" --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2012,i,1175228883555660517,2700246793567650065,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView" --webview-exe-name="WebshareProxyGenerator .exe" --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4560,i,1175228883555660517,2700246793567650065,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView" --webview-exe-name="WebshareProxyGenerator .exe" --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4324,i,1175228883555660517,2700246793567650065,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5176
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView" --webview-exe-name="WebshareProxyGenerator .exe" --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4568,i,1175228883555660517,2700246793567650065,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
      4⤵
      PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/yilkima
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff8cc76c188,0x7ff8cc76c194,0x7ff8cc76c1a0
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,15677516846742532336,2421881274210752552,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:11
      4⤵
      System Time Discovery
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,11398749634327326303,10271345733105375080,262144 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:2
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3060,i,8067692263198741797,770868710870006780,2097152 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3300,i,10775460552414325712,6036239173017136384,2097152 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:1
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3312,i,12645290533381819773,11566510348648726825,2097152 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:9
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3328,i,17146145837975132719,5490546968761856024,2097152 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:1
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,8459256209782384177,10215225527748787419,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:13
      4⤵
      PID:3648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3336,i,11381917207843028909,16362139435934466628,2097152 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:9
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3056,i,13839316381553014462,9417051334391445633,2097152 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,13744777083666697353,4399364176083532821,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,17031733532284366650,7447817829354988739,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5496,i,18319046673551206108,388014912497688783,2097152 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,13658719384491358318,3140231620725856996,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,1563336965322841200,2682220412571654740,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,17262724195862396084,17282642632012761101,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,17262724195862396084,17282642632012761101,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,17665362508627943337,3308878274148157116,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1136
        5⤵
        
        PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,13858280854044147271,10013678427627705348,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,3918373219878160861,459701547292994286,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,14987120504496152285,4438296140411313310,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,14098661169132921521,3842682983573916993,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,14257793671812900818,5414449753047339390,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,18047447580548009731,6732178017542038814,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3048,i,18213804074032463016,12199097761486079850,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3312,i,6461308656519861131,6466381745806835980,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,6139609258858917286,2045514979214958944,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,13067372430317248579,18000050962965722433,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,9830334244506592963,10965332724387561758,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,6886227648645959686,17862121364830739997,524288 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5204,i,1963263372728249012,5220642832673527586,262144 --field-trial-handle=3804,i,1958189821081395255,14521709712425151507,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5360

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\coreinitx64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\coreinitx64.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

coreinitx64.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\coreinitx64.exe.log
Size 1KB
SHA256 6efaeb6a1b391155453a57c7e437575bb18efc174f3099d984d9dea49eecebad
MD5 4a01567f513143419390cb40e6abaf71
SHA1 d0d714d6e526a652fc4e5de4e6040d6b0e7687ab
SHA512 379fcb42d0f72d302482fadd4f25cbfa9c5f6a9c50222877d0eed91f237ec688eb52f65ee0d3fccfd017a6b14bd36f34fa0b77a388728fe3942a981322d7a4bc
TLSH
T17C118C712271B1C489163F431C4D2A4827FF475A7A54EE0CBA98631ED91605B6F223F3
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4970154c03e71372a250182be039e454337be64d232075875a85fe45679e9791
MD5 f5c5af3b32bf2f99864931d9fb64fb42
SHA1 f24e357193c4d16a3e2dd7ccb217f49678a9ab6f
SHA512 e13cff7f429aabbf53f978beb247cb48c5b6dc77f3bd5cc5401dd0008d1b0788c163e99967285b341713f8d21e369c5402e6a1776cbc28df24efbcdd678eba70
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T11EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 de70688c90db4731bd733ff9d3ed2fa7894fe1ae076b016b8cb821197a762578
MD5 31645ffebd5cccb4f21bb606fc916c08
SHA1 284bfe3888dec02120c46b0ed8d195e8dbae56c1
SHA512 8c3558452bb5f90056967484d897e5cd7623a82e8ffbb0ddf8e6a09edcf9ba92218b733d8cae1d1835105c485ef7138c83c051a72b1ac0206078650d13d02c5e
TLSH
T122713C090681D590F7665233E3FD1627F5FDBC9B59376FA1D2A424F86B1D72100B6484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a28.TMP
Size 3KB
SHA256 54dd781ecabe9063367b74f2f6a627e12939005c3aaa3c09956e06acb77f3c2e
MD5 a4e849f23d40e163838a727e0a2b88be
SHA1 8411e9cae7036fb7e9e15ab18fad529d5dc82e4b
SHA512 776e377501921894ecb26a1456cc56f205a58d1fa49f492387f6975ceef9005464496d4c5d215b7a0166e0775b877aadbf69e7a359cda19a32bb933d3dc0b0a3
TLSH
T1907119190A82D690F7261233E3FD1627F5FDBC9B5937AFA2D2A424F86B1D72144B6084
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b17a285a2eeaac33c7b6aa2504c4903f6914f6017ef6d5b48a11cd982212ad8e
MD5 3f20997ac057304e9bc883ce94b17513
SHA1 0159b209c3728c541e50b92b9f9e0c17766b89cf
SHA512 6057c9bf3f54bab9acaed26597c1fd65d2b93877befac1c6f4ab90672dc7398f8f2819799845a1c2faa785d60d3238e807ed7081181b70f8a929fbd2ab540808
TLSH
T120419DF7C3F8866D890156F0BA186E1BCE5D0925536C3D5AC8E4AF1BA3E2871D14095F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a0e153ef1d2fcf9eded6ac560e9755fafcc0848f6f1c94076aff6269d405be97
MD5 008d061c894ea1e04eb7e88879fcd7c5
SHA1 8d9b7bb1e7f42264300d9f7e2c5b67a1f790f282
SHA512 a19dfaaa1417eb9c5c6fb28579677f64725e36d4c4c251543e2b3c1eb961349a3c1844c9afba2bb59aa1e36f17b977e4dc101ed29478d6e2c9ff7e0a4319145c
SSDEEP 192:sxZ1R4yM/jK1Ml8Mcu/fJsOa7BdKIdpCi/W6+WNc8L/Y05CZSIg4J:sxZ1a0u/fJsOabDJ/bD/5Zc
TLSH
T14452FA16AA345977CCDBD209FA55BB53D6F9057392940E44AAFCCB0C04E6AED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 362abc6afae6b4701a9b02a8628c7ecceddf5f4cd3518b5213b379167e2a5795
MD5 ba35aa6670c6d2003c30b244f2b3d9a1
SHA1 c1ed1de3f0299cf0b1f31bb8e37a7759759a3580
SHA512 f2f3355833d94e0a246e866c1d9f353820d1d10c2e796f1b256cb519615041cc8ce72dbf98da9ad08a51bf3a43935b251518af8566d2e8d8e930e36b727959a3
SSDEEP 192:sxZ1R4yM/jK1Ml8UQqcu/fJsGb7BdKIdpwi/W6+WNc8L/Y05oZSIg5SJ:sxZ1aqZu/fJsGbbDb/bD/5DI
TLSH
T1AE62EA1666345977CDDBD209FA557F53D6F9457292940E44AAFCCF0C00E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 a4855092cb1cfcc34e73d05d4e92d6122db468ad6e79494717507bf7fc4d5e01
MD5 f8816d93b7ec23a633caede5c9019dcc
SHA1 57ec1b36e7f84185dfdbc648d0593c9a961116b7
SHA512 131964134dc756e16a4224c957dde2970b3cfa35065d023302cdaca5939d86fadab295ad426ac0f9baa1a0637aebcc6e8610cad71f01a9cc4656c383805c7ce0
SSDEEP 768:IXzXl8pZ2BU7pLuLXJ1WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3XI1/Ll7:IXzXl8pZ2BYEXJ1WRmsYQL0u1jaKXI11
TLSH
T140031C7F280CCB7E4F844E9CEC267F8A6EE8018B96D8895447FA494C03C66EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5b098d1ca4f1c235c5f1fa502fe431867ad7fcf7c4e60156345b40336dc1f8b7
MD5 bb3953a7d1d25ab907b31aebe9fe5960
SHA1 1c54725873cf037dff121b34e75b51765bd0c8e1
SHA512 f1af5b6c41275bb75ca69038383595b5ebb1196383f2fb9def1db4c5b7e5a1fdf6133f6c91068f191dabc3115e0bc200b8fe82ae6b398791556de00503c0f1a0
SSDEEP 96:K9560KDqySywKbihF6HLd7XLSHiMQVRKIYQ3Rk/HKV5y/C7+CQ4Z:zPvIF6HLd7X+HiJVbYQ36/HKV5y/C7+k
TLSH
T1FB91366635B602013D3E350C87E18B27A981B5777059A83B3BA980714E27E62DDFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5932de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5932de.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 1ef07e0b37ae3a0bc4d846b063d472474f049b7b1b69248225de03465998bd74
MD5 cac7f56f50a5fae3d863dac9fe69a647
SHA1 9f0509344cc1595c404a3157d6d8cb68256172d2
SHA512 6d4ca57270d308da744df2e64dded432739a560d1cc2c33b826fcb9bd6a67303f3fb33d9b1b7823c39174163915729e602f01d6069efbf6ae2942d4b58ba40fb
SSDEEP 384:n5iFLtNnNnb9m8N18TUNTUlIl3UECsIc1EujDf4c/k1ElZvFB872+sRDcNP7Z:QFLjZbkEwgPI8uc/UCZdygRDKTZ
TLSH
T14CD2C5F198E79936D9AE4793A33E3E469EBCC15774885994B7C81E0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c602c38869a220acee1feaeb193399d15bf38440ebb173d866861d6075c4000e
MD5 75d17e4de9d3c2fa38ae9f4673578561
SHA1 7422ea4dd84e14ca88139b9ad047cec468746ac2
SHA512 e266bfdda81d66fa3d7a1fb904efe2bb875310f89b33d54c19b288ed0dac503e1bf51612a42496c013a0483f6a2b8ec134f938442345154db316afe7fcb16676
SSDEEP 384:njtNnNnb9c8Nr3UECW1EuK/k1ERtvFB872+sRDcNP7Z:jjZbqKI/UctdygRDKTZ
TLSH
T1DB929D3158B8BC668EE7D627F14B37575FB841AB99C82F94E5EC5F0E40C62CC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3198e6c2c9e4467ca826e7c23a5b6965e861e54c5a024ac88e97a7e71e6249cd
MD5 86f30fd44f46077c1ff76c4194313c7c
SHA1 f05125209f3e9662034f35be8b502dd4e8059d1a
SHA512 ed13f647632380367da4dc4a20a18bdf6db74129613a85956d85ea44e27bdfaa78c339e3f08c2884f498feb1edc68c39dc2beee7f1d3d893fc61a622df0618ae
SSDEEP 192:7GNe6fNNQmiUyUzH6PL/GPTj1UV7q3SbU6:7GNe61LjzaPL/k1UUqU6
TLSH
T19D02E835ACB8787B8EE2AD49F58737175FA5116BAA952F84CAE81F0C40D769C1307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 86fcff8b994c3c3d3e530a5c2d89342e7c6329b95a8d6420964b337a66cfba12
MD5 2207e03de15fa3389aacb8e96a6a7c90
SHA1 ff3d51fb205dd8165346de17434238ce15b827b3
SHA512 ee836786a96872d5c1e8f88b20bb4d9230865a4f2888820e1fb34740579b7712a74dd8731884d7ba16db7b8520b3fbbcdca33d9a0edea653563e5f2f8c25027f
SSDEEP 192:7GNm6fNpQmiUy5S6PL/GPTj1E0YzV3ZKr/mL5U6:7GNm61HKHPL/k1EFLvFU6
TLSH
T183121934A8F8AC2A5EE3A46AF4C737675EA51177DDC96F54D5E81B0C04C629C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0b750c2ca78b141aacb13044e297e03ef27b1a919001169a53b39fd59631456b
MD5 dcf8754a68e201b55c684ee1c96fb804
SHA1 26c7e513a596b3d6e34d756395a9062e89fe1444
SHA512 47070cd5088e09317adfd272849eb50d87a49be29014b054022ef322f3078391d691b8438e706d6c5e5eedb4ce0cba01262c7cf3d7451896255ffc999d656109
SSDEEP 384:nitNnNnb9c8Nr4UECW1EuK/k1ERtvFB872+sRDcNP7Z:ijZbqpI/UctdygRDKTZ
TLSH
T164929D3158B8BC668EE7C627F14B37575FB841AB99C82F94E5EC5F0D40C62DC230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

47611f3c-e9f6-406e-b633-1b06fc60c5a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\47611f3c-e9f6-406e-b633-1b06fc60c5a5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5af5eac8-3397-4f1a-a2cf-5d2af83e77b0.tmp

Path C:\Users\Admin\AppData\Local\Temp\5af5eac8-3397-4f1a-a2cf-5d2af83e77b0.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup.exe
Size 91KB
SHA256 f54c41308b518fd2b5e010990f0de0d39ba4bbb3297df0b1d571b58fb45831b6
MD5 014458e54bcaf9d495a9bd4f233d050e
SHA1 7e84bdb820366cf272cb68a6d9c6eb6f53c46738
SHA512 c9114f8d7caa36ced3d3f98375a1fdbcca8308b0ea72a8fa75bbf6f807c437ff9a9a3a2ce29de42650273ada49a84790891f69b7d1414b5fbd438df9f2e30b26
SSDEEP 1536:zmFhgQhMrWLI2X+Li3xxSXIx/uSbopCbMktSrgpnvf9Tmnp:CFhgQhRLP+LmiIweXSrSvfJy
TLSH
T18493A68372898711D91429B580EF293003E26ED71B33E6C57F4C67ED9E617A3DE81B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebshareProxyGenerator .exe

Path C:\Users\Admin\AppData\Local\Temp\WebshareProxyGenerator .exe
Size 28.6MB
SHA256 52f0ea28e9381a53b6d86d0e8872d7428ebebaedac07b9bdb14b30095856c0fe
MD5 e798a83c24a5be780c8041e671351025
SHA1 d6b70b58e3e1df7c3f625760ccf62c00cf70344a
SHA512 b0d76028e4762d7cc825af167257facbf16a80780994cc304b90a7596bfeeeb36e897bba3990f8cc6665dca3f2e02b2292c1844fb73f2487bbbfc51242d3d78e
SSDEEP 196608:/FL/LyBEqoA3cZSQcX8bdvCIwHliaiZV5u:/x21sZSr8VCIwHK
TLSH
T10D674C23F8A15994D4EAC170D672412BBAA13C690B7413E72690F3241F3BBD0FEB6B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba34f0fd-c5cc-483a-b90a-a59fc319a1dc.tmp

Path C:\Users\Admin\AppData\Local\Temp\ba34f0fd-c5cc-483a-b90a-a59fc319a1dc.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

63c7c52a-5bbd-4f82-a0fe-13b35ecfb24e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1984_222864239\63c7c52a-5bbd-4f82-a0fe-13b35ecfb24e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1984_222864239\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreinitx64.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\coreinitx64.exe
Size 195KB
SHA256 ac2522ebf4b0849da9d911cbec3b55e83c8ab08bb4ebd37b0d8f412fb01d9042
MD5 bbf99c5e602cfeb26dfeaad791418bca
SHA1 ef66d108e34b29c6cdfbc7c7fbe448aa315a4253
SHA512 c043013ee3b10b5ddf0e81d251b03d5e1d0c5148385314a613e6ec21a0a4af7777f58b42f0ec826d71b87ac06e35457f43f7be3a5eb4109a111096fe1046400d
SSDEEP 3072:a8KgaJKKI8h87pLLZ70N1FCbzSoIFLm+TKK1IGqaFhKsyDUIJ5ul/O6HDwbWYHt:RoI8hCfdtbzl+m+MrjJ5ulW6HMbf
TLSH
T17914844376884311D56468B580FF293113E2AED71B33EAD93F4C679E1E117A3DE82B89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
Size 204KB
SHA256 faaa77094e443093d4cca3f8e8a1e11a8e3e6db0fb73bf8bf6337078016b9a81
MD5 e5008d04ee79fa66368209ac57369f56
SHA1 8b4ed72119501de5781b095abb273b3ac49dda63
SHA512 462e795d6ba516c5bd61c219f8c60cdf12b4009a777a2d88e95d6a4678f5725470dd7e3d273da464e6c1774e0b51513bb0d4c54e1cb95db431c4bd88cac05efc
SSDEEP 3072:Dwo+e7I8TkDq3vY3bUiyL3kCKhcZHONiSsAzWddLcbpt7Mbmvs:D3+zYS4iI3+cZuNiSsEiwbLMbm
TLSH
T189246C47B2889755E95865B5C0FB6C3143E2AEC72B33E7D23F40729D1D813A39E82E85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a80ebeca13ea461d6fd42646d5041c0d69e400f346066b9569b8b14de80f4a89
MD5 44db1f3e00a55ff3c7fb23d9cd5c2f41
SHA1 ff63e149f652fd91c2ea08731eca541c50dd699b
SHA512 37b4c0f94c12e9266b210c26b91f0ab0ae7817fa43944897135a738cf95a7081dc35143350bc547ab80f0243c38ec9611cfd49cd31cdb2a92711b2c98efd2eca
TLSH
T104D0041455055C41D54575350011551C4105D4C1000511040510041417C40414C47410
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 06cb8e09360004d8f9065234be36151dd119ee2cf443878b94ab85f6554ab62c
MD5 379938b7e7696de9563dc521322ad63e
SHA1 0de66ed6227f7d35e9a2c690f922a73df5e88520
SHA512 cad398347549160cdf596cc895a0ee5191dd828eee766c6290ed1cfdc755fde77ccbfa51a029f225bc7f2ce0a421149acd79c5283a95e992fb3b4cb260adebc0
TLSH
T128D0241737034D74C41035330003750C0401D14F400D40045C3CCD3D3F4C0D00D07C51
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 b412a3f87dd01877e6178069612b1612d27ebdec71db123acd30360d16d67923
MD5 0b11ae4107883b59643e9c242c27d1b5
SHA1 6c4ce72bd66a4a3e20b4f0a816189fa80f540de5
SHA512 93e35cdd47fad417a0cdf6c17d2a3056a4074f0da4725ec1cbc8384b10854715d31e07ca0259186fb31113b13a8ccc43491f53d892eee5e16aeeb0a4a2c54cc9
TLSH
T1C3B011008A228C82C2A00B30A8C280203832CE0E22A3022A0BA888A888ABBA00000000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 259af50e409c2d170c54fddec47f2207c3165ca7cd542b361ac7ff3a7b5db60c
MD5 ae0ab0b00454800877ef0850e50a3f84
SHA1 4d46631a61f0d133e9349dd61b87b6b4fd982f54
SHA512 e92bc2eeb54978f861d40f7419434332f6b104c028a0cb7cb779fc3404da12b8bb80c5dceb143e91952fbe819fa4f90940233ee7241ca0be5f15f4ccd6f790d8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 4ccf8225f98b881243c7c9920fa710afff7a37c0ec63b2203331ec1f658715b7
MD5 737c5e8f5260000fa7364378f5c6162b
SHA1 cf987c23267cffacf572d60592301066d68914f0
SHA512 3553ed5af3dcdb6131a7bfec9572870a6f5ec1154414a68cf200afd8528aa2b6bfb44819f20503f627234377dc8df6f31d61e3fb1242fee9e101b35331d8a858
TLSH
T1BB016BB2C3E4C67D894512E427247823CD2E041A52282D27CDE9EBEE6BE14B5DA1090F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59620c.TMP

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\Network\Network Persistent State~RFe59620c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\Preferences
Size 6KB
SHA256 8e5294fc019b1db1ff5cfdf02412706aed1d866a16cdbd379fce87dc4268f455
MD5 f59c232f198e731746d7fd1d2165f316
SHA1 cce5fe2b57c51e002304e1749d498ee63a52c692
SHA512 9691ebb43e54d4c6aa2829ad939650bda750155e90a0637c4346acbb1ffbb36690800279094f7cf64803cfbd50559894b9f913a1f6c49e2bdbb408c8d177a674
SSDEEP 96:stA05XT+Ob92ffaZ8i0vhEJkcYm/7qx+WVHMSm+uecSKe1iYAQjN+g6LMOB:stA0RcfyZ8paFR/S+WiQKewYAsYLMC
TLSH
T1A1E19A135E2869774CCBE71ABA39BB12E2F9107266D50F58ABFC8B1C04E65CD520790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58df8d.TMP

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\Preferences~RFe58df8d.TMP
Size 6KB
SHA256 3d3affe250403618cab66c89a2eba7a6ba860629408431e80de08cfcd6e5bdc1
MD5 08af318213d3bd2a0b64ced2caf4b2a6
SHA1 249161e8869ed1f28e053b8ed04678c96fe6f8d4
SHA512 c65971baaf266bd41c5dd3944f3d8bc0892e9de54d993ded3d38bdad369c5ca6022602e455368f694eb1a6f12ec1335ee8dbdb326d390c82de2f80398ec9b56d
SSDEEP 96:stA05XT+Ob95ffaZ8i0vhEJkcYm/7qx+WVHMSm+uecSKe1iYAQjN+gFLMEB:stA0RbfyZ8paFR/S+WiQKewYAsrLM8
TLSH
T16CD199035E2869774CCBE61ABA39BB16D2F9107166D80F58EBFC875C04D66CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Local State
Size 1KB
SHA256 13e09bfc5825f79bc2c4901e94768e59871e319e81a721bced376b71708b31d7
MD5 366f0e5402283e820b611dac80b00f46
SHA1 299b85b924d71a67e0b9751f231b36a482662f9e
SHA512 acb4ac23eb42d9a33443e2ecae4987296156fdfb68bc4783343bcff1136ef4c619800acaf7e3e9541750a9e41b3e089590a66305f9278543bc52c76e71580d40
TLSH
T104316572E4946B7198856607B14AAB572F18107BD3904F8C65EE8F0802D71DCD2B7D33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Local State
Size 2KB
SHA256 ffec68dc368be31841da3a814155cc1cdbc4763fbfe2c1c19a10e612cd648bf0
MD5 c9da7300ddca034f28dd5e761fe731f7
SHA1 4f419a50d659bce98c81ca621bb7c6fe38c88ac3
SHA512 6bcb47caba74114e47ba76055104a0d03d563f1a11742fecbeba4066c78ca77ecff063c8fa00953cd44c9f7589d37ff3f4ca58a12e61973ac3cecffa07614a29
TLSH
T1F751B433B854A73685D75606B94E2F13AF29507ADB902F949AED0F0C01D71AC6393C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Local State
Size 3KB
SHA256 3e299f2f016268e918cbe6f00a16719d966b3118943490b062935b5bc60655f9
MD5 d1daf773ed117034a7eaa6db0130371a
SHA1 5eda9c430a0b2295e86ee8a1bb87af8d5c246866
SHA512 c6f6cfc300370ec8869befe24c809e19285bca0fdf89327a000d5d4adc0bfab4b4bc067450fefa0eb7bcf5ead99131d5c42a610e8b3e20995087e2bc9e102ffe
TLSH
T160717532A964A6274DE79A06F88A2B16BB69503BD6D43F98D9EC0F0D01D72D81392C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Local State
Size 16KB
SHA256 c915d9af2e7c400813dc9f5fec3f2b513b5ec6554fe24f16477d32e9c965a165
MD5 cf5428c66780effd4c57bfe0c60135fd
SHA1 c162f9db68202102d049ddbb6bfef0c92c340997
SHA512 78989dcb596222d2ab8e4e3926842f899ef204437c75bc7394299358f397fb02d6539a2eae1b00911c37667c6b9cb119d6313c7aafbbad30969c9d99f381563e
SSDEEP 384:zzsr8vAVy7dG5UI6limIfB8pNbsXtA2HUGTze:Er84y74GV4O2BTze
TLSH
T1D5729E3162346F2A4CD2DA02F90D1B1B7D6841AEC9D91FB899EC5F0943961D94393E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe584002.TMP

Path C:\Users\Admin\AppData\Roaming\WebshareProxyGenerator .exe\EBWebView\Local State~RFe584002.TMP
Size 1KB
SHA256 c9c120cbc894749b688ff7b6e4895f3fc4fbfaced4180d3225c3c1b86cbd1d86
MD5 be60eb32c4033ae80b0bffcd7897d0b9
SHA1 12941f75badc7fde3f2aef0dfa97f2b288e71e98
SHA512 ca018d1d7b2f8649b1a8c3f769af29b3c8844030737fa40e118298a87fa239604e72285cc689987e2da7c8e6c65d1b45df65352707b9242961144bb98d5690c9
TLSH
T1C4214072E494AB7598851517B146EB872F18507AD3545F8CA1EE8B0802D70ECC2B7C33
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1984_190964491\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1984_298555382\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1984_501034526\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

crl-set

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1428320235\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1428320235\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4000_1853400262\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1496-7-0x000000001CF40000-0x000000001CF50000-memory.dmp

Download

memory/1496-6-0x0000000000B10000-0x0000000000B2E000-memory.dmp

Download

memory/2212-71-0x00007FF8F48D0000-0x00007FF8F48D1000-memory.dmp

Download

memory/2588-191-0x00007FF8F48D0000-0x00007FF8F48D1000-memory.dmp

Download

memory/3984-0-0x0000000000540000-0x0000000002216000-memory.dmp

Download

memory/4084-22-0x0000000000670000-0x00000000006A6000-memory.dmp

Download

memory/4472-44-0x0000000000800000-0x000000000083A000-memory.dmp

Download

memory/4596-445-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4596-759-0x00000000067D0000-0x0000000006836000-memory.dmp

Download

memory/4596-582-0x0000000005770000-0x000000000580C000-memory.dmp

Download

memory/5176-988-0x00000118B4FD0000-0x00000118B4FD1000-memory.dmp

Download

memory/5176-987-0x00000118B4FD0000-0x00000118B4FD1000-memory.dmp

Download

memory/5176-986-0x00000118B4FD0000-0x00000118B4FD1000-memory.dmp

Download

memory/5176-985-0x00000118B4FD0000-0x00000118B4FD1000-memory.dmp

Download

memory/5176-989-0x00000118B4FD0000-0x00000118B4FD1000-memory.dmp

Download

memory/5176-990-0x00000118B4FD0000-0x00000118B4FD1000-memory.dmp

Download

memory/5176-991-0x00000118B4FD0000-0x00000118B4FD1000-memory.dmp

Download

memory/5176-980-0x00000118B4FD0000-0x00000118B4FD1000-memory.dmp

Download

memory/5176-981-0x00000118B4FD0000-0x00000118B4FD1000-memory.dmp

Download

memory/5176-979-0x00000118B4FD0000-0x00000118B4FD1000-memory.dmp

Download