hxxps://www[.]mediafire[.]com/file/uy4xgp8rz58m5ok/Extreme[.]Injector+By+raider464[.]rar/file

Analysis

user interaction
yes
max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/uy4xgp8rz58m5ok/Extreme.Injector+By+raider464.rar/file
Sample260620-3lwa4sbs8t

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5828	Made by raider464.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1080	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264722157133851"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Applications	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c00310000000000ae5c160a110050524f4752417e310000740009000400efbe874fdb49ae5c160a2e0000003f0000000000010000000000000000004a0000000000b17ee600500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Applications\7z.exe\shell\open\command	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Applications\7z.exe	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Applications\7z.exe\shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "6"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5828	Made by raider464.exe
5828	Made by raider464.exe
4212	msedge.exe
4212	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5236	OpenWith.exe
4636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeRestorePrivilege	6072	7z.exe
Token: 35	6072	7z.exe
Token: SeRestorePrivilege	644	7zG.exe
Token: 35	644	7zG.exe
Token: SeSecurityPrivilege	644	7zG.exe
Token: SeSecurityPrivilege	644	7zG.exe
Token: SeDebugPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: SeDebugPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe
Token: 33	5828	Made by raider464.exe
Token: SeIncBasePriorityPrivilege	5828	Made by raider464.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
644	7zG.exe
5828	Made by raider464.exe
4968	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 3096	4968	msedge.exe	86
PID 4968 wrote to memory of 1080	4968	msedge.exe	89
PID 4968 wrote to memory of 3720	4968	msedge.exe	90
PID 4968 wrote to memory of 2092	4968	msedge.exe	91
PID 4968 wrote to memory of 3720	4968	msedge.exe	90
PID 4968 wrote to memory of 3720	4968	msedge.exe	90
PID 4968 wrote to memory of 2092	4968	msedge.exe	91
PID 4968 wrote to memory of 2100	4968	msedge.exe	92
PID 4968 wrote to memory of 5004	4968	msedge.exe	93
PID 4968 wrote to memory of 2100	4968	msedge.exe	92
PID 4968 wrote to memory of 2100	4968	msedge.exe	92
PID 4968 wrote to memory of 5004	4968	msedge.exe	93
PID 4968 wrote to memory of 5004	4968	msedge.exe	93
PID 4968 wrote to memory of 116	4968	msedge.exe	94
PID 4968 wrote to memory of 204	4968	msedge.exe	95
PID 4968 wrote to memory of 116	4968	msedge.exe	94
PID 4968 wrote to memory of 116	4968	msedge.exe	94
PID 4968 wrote to memory of 204	4968	msedge.exe	95
PID 4968 wrote to memory of 204	4968	msedge.exe	95
PID 4968 wrote to memory of 5048	4968	msedge.exe	98
PID 4968 wrote to memory of 5048	4968	msedge.exe	98
PID 4968 wrote to memory of 5048	4968	msedge.exe	98
PID 4968 wrote to memory of 4316	4968	msedge.exe	99
PID 4968 wrote to memory of 4316	4968	msedge.exe	99
PID 4968 wrote to memory of 4316	4968	msedge.exe	99
PID 4968 wrote to memory of 4884	4968	msedge.exe	100
PID 4968 wrote to memory of 4884	4968	msedge.exe	100
PID 4968 wrote to memory of 4884	4968	msedge.exe	100
PID 4968 wrote to memory of 4156	4968	msedge.exe	101
PID 4968 wrote to memory of 2404	4968	msedge.exe	102
PID 4968 wrote to memory of 4156	4968	msedge.exe	101
PID 4968 wrote to memory of 2404	4968	msedge.exe	102
PID 4968 wrote to memory of 2300	4968	msedge.exe	103
PID 4968 wrote to memory of 2300	4968	msedge.exe	103
PID 4968 wrote to memory of 2300	4968	msedge.exe	103
PID 4968 wrote to memory of 3792	4968	msedge.exe	104
PID 4968 wrote to memory of 3792	4968	msedge.exe	104
PID 4968 wrote to memory of 3952	4968	msedge.exe	105
PID 4968 wrote to memory of 3952	4968	msedge.exe	105
PID 4968 wrote to memory of 3952	4968	msedge.exe	105
PID 4968 wrote to memory of 3492	4968	msedge.exe	106
PID 4968 wrote to memory of 4308	4968	msedge.exe	107
PID 4968 wrote to memory of 4308	4968	msedge.exe	107
PID 4968 wrote to memory of 4308	4968	msedge.exe	107
PID 4968 wrote to memory of 4964	4968	msedge.exe	109
PID 4968 wrote to memory of 4160	4968	msedge.exe	113
PID 4968 wrote to memory of 4160	4968	msedge.exe	113
PID 4968 wrote to memory of 4160	4968	msedge.exe	113
PID 4968 wrote to memory of 5788	4968	msedge.exe	122
PID 4968 wrote to memory of 5796	4968	msedge.exe	123
PID 4968 wrote to memory of 5804	4968	msedge.exe	124
PID 5236 wrote to memory of 6072	5236	OpenWith.exe	126
PID 4968 wrote to memory of 6136	4968	msedge.exe	137
PID 4968 wrote to memory of 6136	4968	msedge.exe	137
PID 4968 wrote to memory of 6140	4968	msedge.exe	138
PID 4968 wrote to memory of 6140	4968	msedge.exe	138
PID 4968 wrote to memory of 6140	4968	msedge.exe	138
PID 4968 wrote to memory of 1764	4968	msedge.exe	139
PID 4968 wrote to memory of 1764	4968	msedge.exe	139
PID 4968 wrote to memory of 1764	4968	msedge.exe	139
PID 4968 wrote to memory of 5368	4968	msedge.exe	140
PID 4968 wrote to memory of 5368	4968	msedge.exe	140
PID 4968 wrote to memory of 5368	4968	msedge.exe	140
PID 4968 wrote to memory of 3952	4968	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/uy4xgp8rz58m5ok/Extreme.Injector+By+raider464.rar/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff8c803c188,0x7ff8c803c194,0x7ff8c803c1a0
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,4433662011425147979,12734499185930508515,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,15809826859650044535,8983067433318375342,262144 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,11646686747663542022,18272995542673719413,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,10672556527197721613,9099794391412943980,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,2764006750798327371,13037103263609738646,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,15114409080368981710,844737191692005990,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,13199098338692907135,12188679816289500470,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5096,i,6183544169717473605,8847974927174031701,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5144,i,848888756601449352,3602573062893739625,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5428,i,1541099597792972874,13786886231988569662,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,4176281318567892064,15064455297610271714,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,13503674151930853394,4851706727300619580,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6320,i,12306114972777128217,8977868800780415878,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,412957144833544334,4917752863336196408,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6360,i,6587943759479727140,17436927399342003104,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,16401568574294718079,5982332920515745105,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6964,i,14712922488323124555,2154839499994554097,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,15929992742261199845,1455206950276370983,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,15929992742261199845,1455206950276370983,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7552,i,2444068182208269581,12963824403023558632,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,12293927672780928455,4448402718419828056,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,7117837545955135479,2849940415287392355,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7272,i,5801150932696057799,11510594720972585308,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,920359522072673630,1837301944967214253,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6908,i,3725303200275119127,1601735035185080115,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=2152,i,2771859553656815784,6924233419460942617,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=2140,i,18245449710871904214,16717008957918627871,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8112,i,10184922288769381918,14989688394363504329,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3456,i,15728702517629136396,16448553946989203760,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8144,i,8569754651759317193,522953697711866454,2097152 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,10547340990276231854,7156553212274927379,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1046906114391825105,7025006661712340249,524288 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6792,i,16862826965937169982,8883626443303409618,262144 --field-trial-handle=2932,i,8510923421252794599,9726066494136630249,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" "C:\Users\Admin\Downloads\Extreme.Injector By raider464.rar"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:888

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap29012:120:7zEvent13344
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:644

C:\Users\Admin\Downloads\Extreme.Injector By raider464\Made by raider464.exe
"C:\Users\Admin\Downloads\Extreme.Injector By raider464\Made by raider464.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57a57ae6-c5d3-41c9-bee5-b9cd588105b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57a57ae6-c5d3-41c9-bee5-b9cd588105b7.tmp
Size 8KB
SHA256 40b8bc78a5621d968035f43a2d3a7fef499e78a47d8de94617c8cc971165b1da
MD5 5a6ca715898fb106d98e577731894de3
SHA1 2c140c8457b23be17c5a94c2c89b4d912e9ef2ec
SHA512 2c84c42a85d7ae6b564b1f9efcfe2d8de1dd1eecb0dad86dd9ad13941df27155407d24ddd09b47d02fe9a7a8a1310c60e114621b6076bc427d889c8558ea1995
SSDEEP 96:ZqONkIQsjpfmUTmDK5ih/cIPURHl8h4otop5H5DpBhPwivh50xy0SFYKEAxnO0BP:gONY6kDfQmiUyJvZ903yO4+TQiEMo1U6
TLSH
T16D02D7356C782CBB9EA3AE49F44727275FA5112BEAC52FD5D9E81B0C00C774C2746826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 956293f8e8c5eb8ba6f0e77febf8581463d2cd14ba83174bdc280b1a511f8fa4
MD5 3f7070b09883623beff762ae73426f9c
SHA1 998c831c5f5e14438de14cfb339ec104df3ea46f
SHA512 391d9a94b04356868fbd7aba0f444744e6c41fdcffb7a70ee6094995c2623c354c38706c513b7a16d82ca9fcadddc7312d332861a6603db394339bfdf3c0adf7
TLSH
T18BD023333E45F9C0D035307A942003407E1D031713D1C10B3854440CCC7948067C5EC3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000e8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e8
Size 375KB
SHA256 431a3251deb71c9c6d19db7ece22c26583f9d8fdba96fdfbb6a5b27d4214e31f
MD5 a3e719f84f525e2c6689b3f6ac73c402
SHA1 e3e93bf2c5aa88529ea3c1e524d2350245e91515
SHA512 0816380a9e625ce2e34fef598104a90a2724096b4d627bbe790c58008eeb3c50c732aa24500caa54fdc46c7f63216533adfb46d119a74aff4ed421b9f381ddbc
SSDEEP 6144:bk02i6NJqyLQCeqg5Vici0bU4rCHA9Q9lkOmEeWxF9Mh+kLNYr7tHLh:bMNJqybeqYvxCHAmXmEevbK3Bd
TLSH
T1A4842368F4BFE4A2AE8449215E5E0D746F487EB21740540AFB7DE2BB2415C493B6F203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 56a1d498418bb8692b104d25b9d4af843335c2a5eeb43e2b8527232758b0ba53
MD5 2f433ce040f7e57934bdba69d439a94b
SHA1 1931f3d94dd6a90bb62646fc15ab3eff45323a7d
SHA512 f30e7b71747e553ea4e47ba9031e39775b464e352098b45e21807c742def6215a6a3986fdcf8038fe1e08146e3f524d0bdd248ace3380b25d1be31a768e463cf
SSDEEP 96:MTl3j1lAp2THmclTclUzcZlhglPKM4MAlZZHtElddl18eKlzol0uJAaZlGkx:MTl3j1lAsTGclAlUoZlhglPKM4MAlZZM
TLSH
T12E91F81AECAE4811D732D1B2E4F54D14F2BB08AE29534E326038487D790FFE17C57486
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 02812a2481260547dbd6be733a0019ca142d56eae9a0fe7237b3ab2ed03b08f3
MD5 169d62bd2806b487a13d7635f16ae6b6
SHA1 a7290d1a69fecae74665bc4054cb4a0ec434aa68
SHA512 390b3231c0f345f51e76b0ecd9f68fbb218cc8ad9f88556c870f0d1e491d419e038a2d81a1290fa167ae2d3ac85c101fd894b61f2981d5e6c7edb67b53d81ae6
SSDEEP 192:RTlHl0l3l0lhElMlPlAlwlUlllOlYOlflJl2lQlnDlylYl1LlzUlWllUlClrllkt:RpFcVchMkdAQ8/KYKNrCwn52Ijz8m8mu
TLSH
T1F3121E12BAAD1092CB35C979D2E51C18F7361A8927274F27E0A4513CBF0FBCA7E4E052
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 bc70a38ea901a1444729aa889ebb5b273a6356e380158e706bfd8ece86616406
MD5 13676b7dac104c57658505c92732ce80
SHA1 9c4f09bb270e59c06a2a45d785b99ae3655beee7
SHA512 2883fe037683b29b497fe9bd2dcef97bec6ab20d4f47282554c0c89dccce58d7a75a58a7503465c3793f3229e444b20abd93190fee0badf3d4f6614d3636c860
SSDEEP 384:D87HXT5z+R4hTTpfe6eHdO8AXjxu4ktr4IYmSYEg4pfLAYFmibY9Rxvwzdg+8Itq:21jYCbpc
TLSH
T138425BF7C2E5C61E891117F46614AE1BCE1D0655832C3C29C8D5EF8BE3E2472E25A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 17f477e7f1913eb3928a276e664dd7634ab4f824bf66b0dd54c83ac430688545
MD5 3c19a589eb43b7355fd661f290119ac6
SHA1 fd2ccf16cf13037412591acb1b170072354cb769
SHA512 9e85fa599ac3a4ea0802eeef99b4b4b0356e6c2efd01748f6245ccae521fd2dffcfa3233c4f65dfd076ca7b759def5b8e43c9befdd9531405a0b48952a3ddc73
SSDEEP 384:D87HXT5z+R4hTTpfe6eHdO8AvBZ6GAya+OhB6RU3jxu4ktr4IYmSYEg4pfLAYFmb:p1jYCbET
TLSH
T1D4926CF7C3D5C62DC91116F46A146E1BCE1D0A6983283C2AC8D5EF8BE3E2472E25564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 c61ff4cfc79295292a7c7edf7540aeaae42777cb084bf7f7b0c700a0362ab954
MD5 e11a82d3ecb38099458ef1b1b1b10f5e
SHA1 fec48b61a9f401f06e2decdf2d36189b0da3d196
SHA512 9d3463a2b9400aa4d72cd5023653d81ca4ed4e0669636c8f1bb80f78d4e991d4aa0a6c7d3563a5b002c03899d61da283637407f9f09004a2593a89e232836abc
TLSH
T123D022231306B0B9A56C3E8250BBBC8FC3BA00600856EDD460E0A8DD56314AC57172C5
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59fc48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59fc48.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 28b15989c77d1a565608c27c1259b13ced7c6493463944f399536be00c479d66
MD5 eb39eddf1dff43b0ba7ade8b37f712ba
SHA1 d17282bcc18adc7a169e28642870bf342cb52a93
SHA512 537e03ec0909605fb25b13bed3844b16575915de316e4c7e98404e4d7196b3887777f60fe5967ebad51669a1636379a84ee60c2afc57af3576eb033fb9d6611f
SSDEEP 192:sxZIR8yM/jK1Ml8Mdf/fms2ZtsIdpV2+yymyklHW6+WNItRS1y/Y4NEViIgrJ:sxZIq1f/fms2Zt1OHbs/B9
TLSH
T1F652B7126A345977CCDBD309F951BF63D5F95572A2900D88AAFC9A0C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 c44fb593559f3e59273cb6b649ebad99263902562dec66ccec0ebad1af75c579
MD5 e5b1b84439067d5c344f8e672b05a71a
SHA1 755bb4f7bbbeb9eebb9b0f61c39682d6657f31b3
SHA512 2b5f6669cf00dd6aaf32675a5e0cd59d7e153e84c67822e857652bb2308fbd2f3a21a20f54fa9b6342487e0068625a2830ff7010534583bf6b47e058848ff447
SSDEEP 192:sxZNR8yM/jK1Ml8MUcB4f/fmspZavbsfddpOB2NlZoyymykjfHW6+WNIVXRdbDnW:sxZNqsm4f/fmspZaY5LHbBQy/pmSq4
TLSH
T1AF82D853A6244977CCDBD619B951BF63D6F5046296A04E8CAAFCCA0C04E6BED3203C5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 58db8e40bc4f682e22b70a3254006e2acde73cd87c3d48aa61bd03fa53b7afaa
MD5 11916bc7d7513276a8124013939e5f8c
SHA1 dbe2fa16229645a0d1fe1764e20930669d229d26
SHA512 c2455dad9bf4b658d9181b53cc33cd8659c22f2991635ee4310f2c7b9d26aef3ebf2429b7457a80a9dd3fb9388d9a2e9037fc20b748785b1f975f3698c9681a4
SSDEEP 384:sxZNqqRm4f/fmsGWv1Zazc8sHbLZQyGJFVq4:s1VRm4f/fcY1ZazGHbLwK4
TLSH
T167A2D753553049B7CCE7C619F951BF67D6F91462D6A05E88AAFCCA0C00E6BED2203C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 28c23559d00085429adc6df97e6a957e3be751e4ac6adfb5d50a11b7526464d0
MD5 c6dfc6b4f4a64e9d159e70c99c9b4e1b
SHA1 7fcb2872eb17832141d511ddd532e8aaa4314a08
SHA512 aa92574bb7f8a7aa67f12ea80a94a49c853886f8308d7329243e99015798300cd3bb6141e2fa194288721a7311a1b91ddd4054a8a4543e80b2045911ee829ce9
SSDEEP 192:sxZIR8yM/jK1Ml8M2Pf/fmspZas9bsfddpb2NnyymyklHW6+WNItRdbDnc91y/Yp:sxZIquPf/fmspZaR5VHb/y/i3
TLSH
T13972C712A6345977CCDBD219F951BF63D6F81462A6A05D88AAFCCA0C04E6FDD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 797e7d098f2c0a789cd59eb59c2eeeb12ec44962ec8ddb4f8cae8e3e1e92dfe1
MD5 c4e991684f9201bc69059a664257f7c9
SHA1 335bb5433ed07870213b1625ee38ffafb35011e0
SHA512 cddbfc96be389a88a32d234d3208eaf9eb5bb07d256a855444316fd4a54b80df28be1310d31153d7fcec214e859b0a4ae505c25bd2f32f5de971831d318aabac
SSDEEP 768:c28iJPNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdTroFkcUnS:c28iJPNWvx78ru1jahALocdgBUS
TLSH
T170E20A3B680CCB7E4F844E9CEC266F966DD801CB6B948D5447FA880C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 2f64ab55fa05c8ad0c40a383633c36ba1707cb949b1db6a5a4cc7184f3b5ada2
MD5 0aff8b3647f74ddcfa5e603d63f5c963
SHA1 c2841b2fcc2e416a81e84de87bf0b2074ffc6e26
SHA512 6c66917ded4537416e5819aeb17b3929d2ea75ca51c50e9644f0bf30678c3af60cd9a6f8f8eb8f7c1318577eaefefabbd0748e517af13fed8db41e1f4ff07a52
TLSH
T137A0021B0684014DD06316F2259741413216DA198601174745D58088CA515558D6100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 3KB
SHA256 cb9605f5538b380e3529a866cd0d963fc6cc701556e66951c70c8eb9fc5d6ee0
MD5 c422e0c997f9df23d7a2e96837bf70c4
SHA1 c93e3629a85e1fbc0581dc5ed447fc6bf07345f9
SHA512 3fe0c1c339b99afec6fda028607482b2270c2deda9c7ba8b3a1562badbdaf72777e1d0bcdbfce45c4be93400fccf3aee547d1d0b732055fe40416e18d5bd2553
TLSH
T1BF51C79F4C573B97CDAC117264B508883735B5DC6A449E27A4FC8138ACCB72428BE75C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a3c0a2d4-eac7-4086-937f-54ccbca1fb83\index-dir\the-real-index
Size 72B
SHA256 c69d8d8411fe62fb7ed6d7ea93ef39c191f13233b106d49538d09868ef4cb708
MD5 242ddb96dd4fb1400c5bb19c0db6cdf6
SHA1 563e5e5b693d60ad08f2a9acf2f6545b44f80668
SHA512 9c9955b9b1e101602f175a8683d2ecc99813c0ef08c7b997366379101fcd552e6d0eb0cae10551373f4f9451dcc949a0f2d915b01734017e13b8717ac31b2c67
TLSH
T100A0027029D50161C40206FCF55202942315DD16050E870A78991DD99C591594506064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\df790e1b-a388-4c39-849a-ab203258ba41\index-dir\the-real-index
Size 72B
SHA256 e7b22a62e92916f061512fb77ad3d38d8b176b25c6576b2b7c68bdc019c8e06f
MD5 977757d3a8f6a6a89d88a3b0172c13bb
SHA1 5d4e802c25054370bb89e3fbfdc215dc83704f97
SHA512 e2e347fc1b9bc30ff391a39b0d0f90b6d88aad81b0499b4c3586961de7f2dfeec5297409ec72c325e1ea4407e6f10223158381c0c16cca579f224b5f14e9eb08
TLSH
T1E2A0025A0640E709D1542FF464C121863F224D746161168791B50184FDB7196A507288
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8473.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\df790e1b-a388-4c39-849a-ab203258ba41\index-dir\the-real-index~RFe5a8473.TMP
Size 48B
SHA256 0a15c08e879e46dee2f6374576ba72d48934b7d7a834c47a03dad2cf5da46260
MD5 edd2c526c535ae8c3a06f1f3ba48c835
SHA1 1ef0e3b62894da9265d466d413e797e61aad231b
SHA512 d3f82d663a60011d0c6e7b5624c7e34e7ba0323fb81a5659f33735d9b0a3faae155a5eabf22028bd4574873d9f975905ee531f31cbfe22d9133f4ef3ae1c94ce
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 38fd7385d1a51c21e5f8c018ae448ae7561425404d1b6969194f5b729adfb939
MD5 482eba71d0abac7a14668f89f42658d1
SHA1 d7f1318a62806959b9d8d644f0d77e971f09205d
SHA512 588d115e7045fbf511e3025c119ecdb1edd11bfa268bd35fd103d44fe113d15db8e394b7be31ba4dde1de622233944c9a235c2b744bae02dd3cca4e68c2d28c0
TLSH
T110F097B72FFB1848FDBBA3E510B0A4A00546BC18C041EC8F1416FB83A0B0306301CC62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 e04e78a976d4c13eee4093d7d037c11194e4a1ee84aca57097c623a833b5fa51
MD5 e675447d1881e2d87df892b7d5f6479c
SHA1 ccef39b7884d1d1514038b6c73529f7d357bfbee
SHA512 4ccdf18af907ff704ad87e4305e22a2e05c256f40c9aeb2a9c18c22dcdb4bdd83919d16274d5877765df7f1933923f6bdeed2f4acb2953e384e261025c0592a1
TLSH
T1D7F097B72FFB1848FDBBE3E110B1A8600206B818C051EC8F1416FB8350B03063018C62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 2c0dc055f438d3998147325679ec6a37ccff9d7d855106db7f65708487f6d8c0
MD5 f247de3679dd203cd28c3b635dfeb976
SHA1 ec7f50c9a0185a01597b351b71375acc3f1cd7c6
SHA512 f4427d971156656b6868cd38f735ea5c0b177eedd6d506739a17b2ab1479895b2d239ed49b05d24918c136222eb952f5244a688f99188a2cb3662e647229ad69
TLSH
T182B0223ACA2C8022C0800B30F0B2C82832308CB00B8F222280F8E2F88C8222020B20CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a17bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a17bf.TMP
Size 48B
SHA256 a3c6f9d0a21c39b5bd5799242068d6ab85b6f0b92a70b7ca09026f3e92fe9c3e
MD5 b12aec6f8521190aa004849c53bcb3e9
SHA1 8561def0f04e929bf76942f2d33fe487cc0edacb
SHA512 c1e304e3531fbd9f540cef0c9994592927c306e7ab9f1a201225cbd051ed41f5e642825f39327fa112f814eaf7c97a686bdedcbff765e2c30265e87a45903990
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 29cee723f08a7b348d6db0a58033cd72018a01c5ea7ce18b383d0b47c383defa
MD5 28de9a11c70bc1dc50ce803d5760431b
SHA1 db7e4e293ff8536cc93fc53c8dc525eac3bc2380
SHA512 2532e52a9c7c3950ac1a9e8eccc3d90ce5d5a5e5c110c8d51e1a656c9e84b1784c507336b7c830f8e277d5b2b596fd539ba9888b738d3eef71526656110af257
TLSH
T160A002507580404DC01002F410D1E25067286C611105175660F818579DA43904743050
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f147a69892b0c4b950479b8cfa43bb47b737324bfbb0e2e1198b4beb0f11366b
MD5 3f49c539cc93545bca979fe2d88b452c
SHA1 e9205137c177c004f11742f994de422b67d8c972
SHA512 8f82db0db6ddb49a2f5cf69b30270f9f9779bf263ac28cbdc7bda00673cd300c41b19dc8f4544d5776a2de81099656f455ca391738bb5737df91bea315e3606d
SSDEEP 96:KkOkKHK6TEPIkumW28mJ9Wk2K+TWi2yMERStrKKMM+R:S3TEPIkumWlmJkk0TWi5MERSoBR
TLSH
T1ED918F0532BB53153D3F686992D48A6B17423973306EA42B7BA840A54E66E340FFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 aa4bacfdb0f35dd2b2ee64de5687cd9062c7621ab89a629cac56b96c26df792f
MD5 1e9d6599e5b7f0df28d8a8a9696ddf6e
SHA1 393f619de126a9968e9e9eb841264e12971fb530
SHA512 cc0a658bb0b965f77bd1cdcb16063e0b92effea2e63fd4c8d0be2996824e9443b3b833297de674f89021c27f46314aa5f44f5330bb6304a4bd87ffbf78cf1dca
SSDEEP 384:/tNn/s3n9SBsN/NIMaY35kMJkhOp3VekE8ITGT0Iyfx9N:/j+92XeeOpBE8i+0XvN
TLSH
T185929D335938AD2B4EA39449F40A371B5EB045A7E6C92FD9D9DC2F0C04CA3AC131A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 226166467618e715b8de6e8483b54273ffbb6c8fb8045e5fbe192677166186a1
MD5 135f9972d6d349d1dace1e249d179806
SHA1 6dc2ddbbf64e39cd663b928c56a5f1199b3bd421
SHA512 4f1b0b9ad1db97847c1fe60eae64caf202ef2daee6a0dc4f9ab627032b31215bb822939ea8ac064d77dd4cce97c744685c0a1707bce6ad53910866d02baac406
SSDEEP 384:rtNn/s3n9S/9sN/NTSMaY35w7++88BkhOp3VeVE8ITGT0Iyfx9N:rj+9KPZ++88WOpmE8i+0XvN
TLSH
T181B218F259E75936C9AE5347B73D2E170EBCC067B5842A85B7DC1A0CCC862BFD206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a1d68c7d0e29cfc1d12c794f971c08172f72286b926b562d00166c40db1d993e
MD5 76da51d6b9369fcf34e8fbea9f94b599
SHA1 4f2b204148f5ad9989cc2aaafc13f2f94d92b614
SHA512 1602a19dbefe52ca9301bae84cec95ae51526ce41f8e88ce83feded8e9a51eec7f6d8dd7f05023b84700b1bae72b1793e87da13e18c97e17e4e41724da31e361
SSDEEP 384:gtNn/s3n9S/IsN/NTSMaY35X7++9gkhOp3VenE8ITGT0Iyfx9N:gj+9LPk++9HOpWE8i+0XvN
TLSH
T175B218F259E75936C99E5347B73D2E170E7CC167B5842A85B7DC1A0CCC862BFD206405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0ef66806ddca2431d297adf151dea682c1dd00cce4e9b85e95747dd8cfcae066
MD5 dbcdd986c0c24f664ee4af5d6b233a27
SHA1 626c8986d53829db8525a275c58811771b24e520
SHA512 8984a6846fd84af87bf6316d3f2845e46ad2bcb2cbcf74483d8c040065cc8d4654b331db9e238c3bd657dcd0cb769874abc40244a98281cf4ca2cda317d05eb9
SSDEEP 384:rtNn/s3n9S/IsN6NTSMaY35O7++9gkhOp3VeyE8ITGT0Iyfx9N:rj+9LYx++9HOpzE8i+0XvN
TLSH
T110B228F259E75936C9AE5307B73D2E170EBCC067B5842A85B7DC1A0CCC862BFD20A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9c832d1530e58116d73b97777d0fb9b9429dba64389fee38d986d95eac07e248
MD5 07dc7b1ca0977dc089197ce39e8a741f
SHA1 56a7f814ff10937ca0140232698f54deae146378
SHA512 420ddaf377d8bd9e4828c66ddb6a12e387b3af454be20938c9e0f36bab63570c87ee504007e6b55466d7fdfac935b43e3361010e68e6b9b6524c5f0853d94661
SSDEEP 384:AtNn/s3n9SZQsN/IIMaY35xMJkhOp3VeEE8ITGT0Iyfx9N:Aj+9tcdeOpdE8i+0XvN
TLSH
T1B4929E335A38AD2B5EA39449F40A371B4FB045A7E6C93FD9D5DC2F0C04CA3AC131A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5cec54be92a79114ec29bdba56a4cc448b57086c35dcb2bd2d96865f08f0e25d
MD5 6352d47c9f610d8f2ffaf13688f3846c
SHA1 71cba85f3b3c1db897142aaccb0dd6da85551c2c
SHA512 bc481666ddce3926312b76f8c5893b7186d89e0d9d5e80e73668183565ec24a7e77224252fbe9758dbce82d5aaa101985ee7c21a68fe40d0b32821256b7b626d
SSDEEP 384:ttNn/s3n9SEsN/sIMaY35NMJkhOp3VeEE8ITGT0Iyfx9N:tj+9/QVeOpdE8i+0XvN
TLSH
T19D929E335A38AD2B5EA39549F40A371B1EB045A7E5C93FD9D9DC2F0C04CA3AC131A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 309ae6cb692729d1580053e511c5c772ae083afd5e2867be099c0b993b0aa1bb
MD5 d9dcbeb93257bc22c06f24bb21723f0b
SHA1 2e0954052526b95ee39e3f71a77dacefb7cc355a
SHA512 1d9b668b089cd579f263845d20bcd8cbce72c1aeefb7c2be192db8a92f2aabc59485d952edff2ce6a9a0b40fc511cc863156b2e1415532865c59ea505e24507f
SSDEEP 192:8ONi6kDQmiUy0vZ903yO4+R5pbr9ePcREEqWU6:8ONi6gZZ9hOp3VeQE8U6
TLSH
T1D812293268785C2B5EE3A949F48737235EA5812BEBC83FD5D5DC2B1C05CB39C130A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 0b6e697716eb7696e94875d8f3460112bcea0e47d200c177f928ee0da6afa4fe
MD5 14d7fffac7ef2f3d7b9909a7715582da
SHA1 367af2cf1b334b446a507e764c0bb9c24b14a22c
SHA512 f5d31fc26f466074ccbc63d98bc070d3cdbd3291051066ebd3577894c3b5ead6d9324a019cf1eff0a3b392343107ed36c2e16b4120fb9dbc703a6a8800b4f140
SSDEEP 384:ItNn/s3n9S/IsNfNTSMaY35OK+++gkhOp3VeydjvDV4Ezi/x/O61qKkBvITGT0IK:Ij+9LTA+++HOpzJh4i61qtvi+0XvN
TLSH
T16BE238E294E75DB6C49D93CB636DAD06297CC137B188198CB3E8662CEC8B1BFC311815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fe3ec11e1aed96803997f67032bee7ac789b12b9d82a51a664b43bbd1c1e63ec
MD5 ad0c8814ec825e83ddf1fcd264ded8b4
SHA1 628f4ecd0d2d16b285122d016df38a2ddffeedf0
SHA512 3b21701eaf0c16cd6624e623599a4fe5c81e8e91481c0716d98b308f29b42bb796dec23409ef3a386cfd9a8566e20502ae1a1fe6fe3ee2affbdddf40870590d8
TLSH
T179E00111930441BED03C033500976B34BBEAC42002B6031B0A2206AC2D227403FB1ED0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 db2c1efa65c1c49699fbf77b4e1fb50a26ff2de6de2ab5758bc04af41c999cd3
MD5 0573a1f70b7d33173eabbdf40812ccc5
SHA1 c3796c8652359727ff3fc9fce6e46e5533668d56
SHA512 8a916c2847bfe2795ec10810584d892fbee36759cd597a1b27600b58db8bd67d8ef9b800fdd3c90d2751299eceef714890959689df213c230607c1fb670a14f6
TLSH
T1B9E00212930441BEC03C033400972B309BDBC42002F5031B0910029C2D133002FB1FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59bcfd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59bcfd.TMP
Size 392B
SHA256 783eb6374bae30feced3145285b296febdf406b7ed8ee4367d0b5fd9814162df
MD5 2d7567c45df14c8de96af6775fbc353b
SHA1 574276bd7c348a0c43c26a3b1aaaef10f25c2df2
SHA512 024882c41b21b3dacee0c4e0cab6c458db9f04cb511db7157660d61be4691ad9d55f0bd3143528c04a319c371444882f2800285ded12cd2ff5cca5fe7879d117
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 cd583e42d4d61c85ab08adb847b5f43d86f17c7f551070edbca2f64533007add
MD5 160df24d96c3fd041723170604f9e748
SHA1 bf757db1980c2741645333d0baaa9a68f9d30603
SHA512 dc98f5d10f13962c92f2ee6152a55af5c7bf27529101a53b8ab63e2c342f864400d966aaa731d9a59b75b669f14572a378ef375738a29eed6fc0c5a34712738b
SSDEEP 3:MsEllllkEthXllkl2zExllFlWq:/M/xT02zYd
TLSH
T141440404FFC50C05C50074304173C3504374D7104531574334550457FCD55400C05101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34a6ee2f-f7a8-4fbc-a324-e64999933fd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\34a6ee2f-f7a8-4fbc-a324-e64999933fd0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0f0efdc56c9fe3e3f4b9ac4ca934473b86ad5096e9e4bcad0c00e6aa37b3a31c
MD5 49b6f8d2eb547b78436305ec84445a0e
SHA1 c8ecfe91d07cb35220820fb1f09b5e13b3fafe94
SHA512 51ace4b73e57445dc10c611d4848044df479c33bc9e243702243e0b935f0e8e995a25cedb553d0cc028477dd56506b4795a62c59d9c5422fca6a4a298f83e5fd
TLSH
T179412A5CBBE91148B3B76E4AAFF6A86D447EB9372E06D45D00110D4F0662A40C972737
MD5 SHA1 SHA512 TLSH

Submit Download

Extreme.Injector By raider464.rar

Path C:\Users\Admin\Downloads\Extreme.Injector By raider464.rar
Size 1.2MB
SHA256 37e0bbd859f04c0de3f0b2f1bc2ec7572e2fae47b3857b35ce5b33882efaef6e
MD5 57715c41393c8f8528a0f55e9eb7b0f8
SHA1 f3cbf20a570752cc6e9b3a1685b8cd5f365af458
SHA512 9c78e97ef93d16b06b3856af0bc64de89c51f259f8564c643fad75c934bafcb74c808c34ea0dd0cb7765d161e0598b128a365ab47744b403fad98792179f91c5
SSDEEP 24576:4PXJjq/ynwb/q9eDXisdHbfvwIdWHUg2a7E7skucwW3882nHYFaPNt:4PZGanfYDHdHwHUVWEAg3gnHYFGNt
TLSH
T14C55335F77328CC8E87510F1227DC7365FE9691ABDB771285B642DAA82E08F4AE12D10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Made by raider464.exe

Path C:\Users\Admin\Downloads\Extreme.Injector By raider464\Made by raider464.exe
Size 1.9MB
SHA256 b65f40618f584303ca0bcf9b5f88c233cc4237699c0c4bf40ba8facbe8195a46
MD5 ec801a7d4b72a288ec6c207bb9ff0131
SHA1 32eec2ae1f9e201516fa7fcdc16c4928f7997561
SHA512 a07dd5e8241de73ce65ff8d74acef4942b85fc45cf6a7baafd3c0f9d330b08e7412f2023ba667e99b40e732a65e8fb4389f7fe73c7b6256ca71e63afe46cdcac
SSDEEP 49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9a:NNEVJyZlng4p2V
TLSH
T1B8956D997650B69EC89BC932CAE51C2CF760A07B571BC343A46325EC9D4DA9BCF041B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.xml

Path C:\Users\Admin\Downloads\Extreme.Injector By raider464\settings.xml
Size 2KB
SHA256 359e8731ad58aa41f3bdc9c0bf25a56796fc615f1b46db2ce107458415ad3f42
MD5 4bac4c431298fabfbc03bb6b906be42a
SHA1 685de6ecf0d9e4456ff1eb51e22fc92cef862c6f
SHA512 11ce54d0216125bbbb4e3109f8f04b57ac865cc30da905ffa07b4f3ff8d08c4b790eabd474e5d873a5fb0799276fc006aa5de4d5272327e2802d7e4dea0bd62c
TLSH
T14F4157A0ABC6790CE6FB556F93369547DC6940A2832228E0B86C821F6F371477B53C36
MD5 SHA1 SHA512 TLSH

Submit Download

settings.xml

Path C:\Users\Admin\Downloads\Extreme.Injector By raider464\settings.xml
Size 2KB
SHA256 3df76127128061399732a32298b3517d091a804dc0ec8bf7288b4a203a30923a
MD5 942999c33aa8e774decf300e0b51b2e3
SHA1 5c8cedf7de17302230e56c971806f61abbb87bc5
SHA512 54ccbe230923bca829028d2fbfcce15432ba52726f1aadbf40235cb43d555a73af357a79e1ee454cb412a24e9ecca7dc0f6543d14c9125267583cb1eb8399400
TLSH
T1964149A0ABC6750CF6FB566F93365547DC6940A2832228E0B86C821F6F3714B7B53C36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5828-446-0x0000000000DD0000-0x0000000000FB6000-memory.dmp

Download

memory/5828-449-0x000000001C090000-0x000000001C0CC000-memory.dmp

Download

memory/5828-447-0x000000001BC40000-0x000000001BC52000-memory.dmp

Download