77cd56844de4bc403b8b5fd921a295f639a932960665d31618f1395ffa6bd228

Analysis

user interaction
yes
max time kernel
167s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/06/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EZFN Launcher_1.3.3_x64_en-US.msi
Size 7.4MB
Sample260623-gp5hasav7k
SHA256 77cd56844de4bc403b8b5fd921a295f639a932960665d31618f1395ffa6bd228
MD5 706c630a1461c1e2c42eae975a28b986
SHA1 9265d799175eeb39e4d842bf523eb5f127c96968
SHA512 822662a2e1d52508fd31abf9906ee7390ac289ff8864f4bc04b33f2b3228bd0b234a771a54b0796cfe988896c4e5c5dda38125519bae07b6d6862b0a41a50fd2
SSDEEP 196608:eZvzCsZWZNoCZR5kUS4m126mXHv8VKY2XH7112v:czPZONo6/kF4moXPCKBL112v
TLSH
T13676334B3E84A661D4A70D765875EB918F3DBC244B6489C32386B309EFF02D10FB65DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	EZFN Launcher.exe

Executes dropped EXE 5 IoCs

pid	Process
3140	EZFN Launcher.exe
4484	EZFN Launcher.exe
5132	EZFN Launcher.exe
3888	EZInstaller.exe
6228	EZInstaller.exe

Loads dropped DLL 28 IoCs

pid	Process
4056	MsiExec.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe
6228	EZInstaller.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EZFN Launcher.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EZFN Launcher.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1640_1616986765\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1640_1840548668\manifest.json	msedge.exe
File opened for modification	C:\Program Files\EZFN Launcher\_up_\public\default_skin.png	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1640_1616986765\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1640_1840548668\nav_config.json	msedge.exe
File created	C:\Program Files\EZFN Launcher\EZFN Launcher.exe	msiexec.exe
File created	C:\Program Files\EZFN Launcher\_up_\public\default_skin.png	msiexec.exe
File created	C:\Program Files\EZFN Launcher\Uninstall EZFN Launcher.lnk	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\EZFN Launcher.exe	msiexec.exe
File opened for modification	C:\Program Files\EZFN Launcher\Uninstall EZFN Launcher.lnk	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1640_1348575350\manifest.json	msedge.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{ED5C5759-EE42-4338-83F8-E608577764DA}	msiexec.exe
File opened for modification	C:\Windows\Installer\{ED5C5759-EE42-4338-83F8-E608577764DA}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e589fd8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE655.tmp	msiexec.exe
File created	C:\Windows\Installer\e589fd5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589fd8.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7F6C65EE-B4ED-4996-9201-7FC232803C8A}	msiexec.exe
File created	C:\Windows\Installer\{7F6C65EE-B4ED-4996-9201-7FC232803C8A}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e589fe4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589fd5.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA10D.tmp	msiexec.exe
File created	C:\Windows\Installer\{ED5C5759-EE42-4338-83F8-E608577764DA}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e589fd7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE75F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{7F6C65EE-B4ED-4996-9201-7FC232803C8A}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5148	msedge.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266680477982431"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Version = "16973827"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298\9575C5DE24EE8334388F6E80757746AD	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\ProductIcon = "C:\\Windows\\Installer\\{7F6C65EE-B4ED-4996-9201-7FC232803C8A}\\ProductIcon"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\DefaultIcon	EZFN Launcher.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE56C6F7DE4B69942910F72C2308C3A8\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{33C85ED0-9F92-4B68-9852-AF348384894F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\shell\open\command	EZFN Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE56C6F7DE4B69942910F72C2308C3A8\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn	EZFN Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\DefaultIcon\ = "C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe,0"	EZFN Launcher.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Assignment = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\Version = "16973828"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\URL Protocol	EZFN Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\ = "URL:org.ezfn protocol"	EZFN Launcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\DefaultIcon\ = "C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe,0"	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\PackageCode = "6DCBEC1DFAF579E49B5C05DC7D09838B"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList\PackageName = "EZFN Launcher_1.3.4_x64_en-US.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9575C5DE24EE8334388F6E80757746AD\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\shell\open\command\ = "\"C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe\" \"%1\""	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298\EE56C6F7DE4B69942910F72C2308C3A8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EZFN Launcher-1.3.4-updater-qs02uG\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\shell\open\command\ = "\"C:\\Program Files\\EZFN Launcher\\EZFN Launcher.exe\" \"%1\""	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\PackageCode = "60959306AC750F547825A0F9396B9C69"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\URL Protocol	EZFN Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\DefaultIcon	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE56C6F7DE4B69942910F72C2308C3A8\MainProgram	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\ProductName = "EZFN Launcher"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE56C6F7DE4B69942910F72C2308C3A8	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\ProductName = "EZFN Launcher"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\148EDAE345EAC3E54B1170CBD502D298	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\shell\open	EZFN Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EE56C6F7DE4B69942910F72C2308C3A8\External	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE56C6F7DE4B69942910F72C2308C3A8\Language = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\shell\open\command	EZFN Launcher.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9575C5DE24EE8334388F6E80757746AD\SourceList\PackageName = "EZFN Launcher_1.3.3_x64_en-US.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ezfn\shell	EZFN Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1588	msiexec.exe
1588	msiexec.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
3140	EZFN Launcher.exe
1588	msiexec.exe
1588	msiexec.exe
1588	msiexec.exe
1588	msiexec.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe
4484	EZFN Launcher.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3484	OpenWith.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1312	msedgewebview2.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	724	msiexec.exe
Token: SeSecurityPrivilege	1588	msiexec.exe
Token: SeCreateTokenPrivilege	724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	724	msiexec.exe
Token: SeLockMemoryPrivilege	724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	724	msiexec.exe
Token: SeMachineAccountPrivilege	724	msiexec.exe
Token: SeTcbPrivilege	724	msiexec.exe
Token: SeSecurityPrivilege	724	msiexec.exe
Token: SeTakeOwnershipPrivilege	724	msiexec.exe
Token: SeLoadDriverPrivilege	724	msiexec.exe
Token: SeSystemProfilePrivilege	724	msiexec.exe
Token: SeSystemtimePrivilege	724	msiexec.exe
Token: SeProfSingleProcessPrivilege	724	msiexec.exe
Token: SeIncBasePriorityPrivilege	724	msiexec.exe
Token: SeCreatePagefilePrivilege	724	msiexec.exe
Token: SeCreatePermanentPrivilege	724	msiexec.exe
Token: SeBackupPrivilege	724	msiexec.exe
Token: SeRestorePrivilege	724	msiexec.exe
Token: SeShutdownPrivilege	724	msiexec.exe
Token: SeDebugPrivilege	724	msiexec.exe
Token: SeAuditPrivilege	724	msiexec.exe
Token: SeSystemEnvironmentPrivilege	724	msiexec.exe
Token: SeChangeNotifyPrivilege	724	msiexec.exe
Token: SeRemoteShutdownPrivilege	724	msiexec.exe
Token: SeUndockPrivilege	724	msiexec.exe
Token: SeSyncAgentPrivilege	724	msiexec.exe
Token: SeEnableDelegationPrivilege	724	msiexec.exe
Token: SeManageVolumePrivilege	724	msiexec.exe
Token: SeImpersonatePrivilege	724	msiexec.exe
Token: SeCreateGlobalPrivilege	724	msiexec.exe
Token: SeCreateTokenPrivilege	724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	724	msiexec.exe
Token: SeLockMemoryPrivilege	724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	724	msiexec.exe
Token: SeMachineAccountPrivilege	724	msiexec.exe
Token: SeTcbPrivilege	724	msiexec.exe
Token: SeSecurityPrivilege	724	msiexec.exe
Token: SeTakeOwnershipPrivilege	724	msiexec.exe
Token: SeLoadDriverPrivilege	724	msiexec.exe
Token: SeSystemProfilePrivilege	724	msiexec.exe
Token: SeSystemtimePrivilege	724	msiexec.exe
Token: SeProfSingleProcessPrivilege	724	msiexec.exe
Token: SeIncBasePriorityPrivilege	724	msiexec.exe
Token: SeCreatePagefilePrivilege	724	msiexec.exe
Token: SeCreatePermanentPrivilege	724	msiexec.exe
Token: SeBackupPrivilege	724	msiexec.exe
Token: SeRestorePrivilege	724	msiexec.exe
Token: SeShutdownPrivilege	724	msiexec.exe
Token: SeDebugPrivilege	724	msiexec.exe
Token: SeAuditPrivilege	724	msiexec.exe
Token: SeSystemEnvironmentPrivilege	724	msiexec.exe
Token: SeChangeNotifyPrivilege	724	msiexec.exe
Token: SeRemoteShutdownPrivilege	724	msiexec.exe
Token: SeUndockPrivilege	724	msiexec.exe
Token: SeSyncAgentPrivilege	724	msiexec.exe
Token: SeEnableDelegationPrivilege	724	msiexec.exe
Token: SeManageVolumePrivilege	724	msiexec.exe
Token: SeImpersonatePrivilege	724	msiexec.exe
Token: SeCreateGlobalPrivilege	724	msiexec.exe
Token: SeCreateTokenPrivilege	724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	724	msiexec.exe
Token: SeLockMemoryPrivilege	724	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
724	msiexec.exe
3140	EZFN Launcher.exe
724	msiexec.exe
1640	msedge.exe
1640	msedge.exe
6096	msiexec.exe
6096	msiexec.exe
4484	EZFN Launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3484	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4056	1588	msiexec.exe	96
PID 1588 wrote to memory of 1736	1588	msiexec.exe	103
PID 724 wrote to memory of 3140	724	msiexec.exe	106
PID 3140 wrote to memory of 1312	3140	EZFN Launcher.exe	108
PID 1312 wrote to memory of 1612	1312	msedgewebview2.exe	109
PID 1312 wrote to memory of 1864	1312	msedgewebview2.exe	110
PID 1312 wrote to memory of 1864	1312	msedgewebview2.exe	110
PID 1312 wrote to memory of 1864	1312	msedgewebview2.exe	110
PID 1312 wrote to memory of 4932	1312	msedgewebview2.exe	111
PID 1312 wrote to memory of 3732	1312	msedgewebview2.exe	112
PID 1312 wrote to memory of 3732	1312	msedgewebview2.exe	112
PID 1312 wrote to memory of 216	1312	msedgewebview2.exe	113
PID 1312 wrote to memory of 216	1312	msedgewebview2.exe	113
PID 1312 wrote to memory of 216	1312	msedgewebview2.exe	113
PID 3140 wrote to memory of 1636	3140	EZFN Launcher.exe	115
PID 1636 wrote to memory of 1640	1636	msedge.exe	116
PID 1640 wrote to memory of 3568	1640	msedge.exe	117
PID 1640 wrote to memory of 5140	1640	msedge.exe	118
PID 1640 wrote to memory of 5148	1640	msedge.exe	119
PID 1640 wrote to memory of 5140	1640	msedge.exe	118
PID 1640 wrote to memory of 5140	1640	msedge.exe	118
PID 1640 wrote to memory of 5172	1640	msedge.exe	120
PID 1640 wrote to memory of 5172	1640	msedge.exe	120
PID 1640 wrote to memory of 5348	1640	msedge.exe	122
PID 1640 wrote to memory of 5348	1640	msedge.exe	122
PID 1640 wrote to memory of 5356	1640	msedge.exe	123
PID 1640 wrote to memory of 5348	1640	msedge.exe	122
PID 1640 wrote to memory of 5356	1640	msedge.exe	123
PID 1640 wrote to memory of 5356	1640	msedge.exe	123
PID 1640 wrote to memory of 5496	1640	msedge.exe	124
PID 1640 wrote to memory of 5504	1640	msedge.exe	125
PID 1640 wrote to memory of 5496	1640	msedge.exe	124
PID 1640 wrote to memory of 5496	1640	msedge.exe	124
PID 1640 wrote to memory of 5504	1640	msedge.exe	125
PID 1640 wrote to memory of 5504	1640	msedge.exe	125
PID 1640 wrote to memory of 5768	1640	msedge.exe	127
PID 1640 wrote to memory of 5768	1640	msedge.exe	127
PID 1640 wrote to memory of 5880	1640	msedge.exe	128
PID 1640 wrote to memory of 5880	1640	msedge.exe	128
PID 3140 wrote to memory of 6096	3140	EZFN Launcher.exe	129
PID 1640 wrote to memory of 5528	1640	msedge.exe	131
PID 1640 wrote to memory of 5384	1640	msedge.exe	132
PID 1640 wrote to memory of 5528	1640	msedge.exe	131
PID 1640 wrote to memory of 5384	1640	msedge.exe	132
PID 1640 wrote to memory of 1580	1640	msedge.exe	135
PID 1588 wrote to memory of 4484	1588	msiexec.exe	136
PID 1640 wrote to memory of 5368	1640	msedge.exe	137
PID 1640 wrote to memory of 5368	1640	msedge.exe	137
PID 4484 wrote to memory of 540	4484	EZFN Launcher.exe	138
PID 1640 wrote to memory of 5132	1640	msedge.exe	144
PID 1640 wrote to memory of 5132	1640	msedge.exe	144
PID 1640 wrote to memory of 3220	1640	msedge.exe	145
PID 1640 wrote to memory of 3220	1640	msedge.exe	145
PID 1640 wrote to memory of 4540	1640	msedge.exe	146
PID 1640 wrote to memory of 4540	1640	msedge.exe	146
PID 1640 wrote to memory of 6552	1640	msedge.exe	147
PID 1640 wrote to memory of 6552	1640	msedge.exe	147
PID 4484 wrote to memory of 6856	4484	EZFN Launcher.exe	148
PID 1640 wrote to memory of 6924	1640	msedge.exe	149
PID 1640 wrote to memory of 6924	1640	msedge.exe	149
PID 1640 wrote to memory of 6924	1640	msedge.exe	149
PID 1640 wrote to memory of 3984	1640	msedge.exe	150
PID 1640 wrote to memory of 3984	1640	msedge.exe	150
PID 1640 wrote to memory of 3984	1640	msedge.exe	150

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\EZFN Launcher_1.3.3_x64_en-US.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:724
- C:\Program Files\EZFN Launcher\EZFN Launcher.exe
  "C:\Program Files\EZFN Launcher\EZFN Launcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --no-proxy-server --lang=en-US --mojo-named-platform-channel-pipe=3140.4484.10121593172094652109
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffcd376b078,0x7ffcd376b084,0x7ffcd376b090
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,4346088460439084269,2626254678225181223,262144 --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
      4⤵
      PID:1864
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1396,i,4346088460439084269,2626254678225181223,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2404,i,4346088460439084269,2626254678225181223,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,4346088460439084269,2626254678225181223,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
      4⤵
      Drops file in Program Files directory
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffcd458c188,0x7ffcd458c194,0x7ffcd458c1a0
        5⤵
        
        PID:3568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,6311962443430848395,3992304308155755427,262144 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
        5⤵
        
        PID:5140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,3063735001239819266,8035301079595598834,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:5148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,3654965880868815828,14926848672582766283,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
        5⤵
        
        PID:5172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,1014935067139192978,3314161050389162522,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
        5⤵
        
        PID:5348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,2241751102774562423,12538020719707203059,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        5⤵
        
        PID:5356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,15458261234434599454,11252950386380798734,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
        5⤵
        
        PID:5496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4112,i,2521471623607424945,13559904641131853280,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:2
        5⤵
        
        PID:5504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,2090771659472984172,9123470326179897489,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
        5⤵
        
        PID:5768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,8618547691306689181,4816614612326847855,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
        5⤵
        
        PID:5880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,18054968721451874317,15301242117577177853,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
        5⤵
        
        PID:5528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,11326317716617039255,12149750288175687536,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
        5⤵
        
        PID:5384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,10868475493443750707,5689176421233438277,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
        5⤵
        
        PID:5684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,10868475493443750707,5689176421233438277,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
        5⤵
        
        PID:1580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1493457073978969873,2389723914033409550,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
        5⤵
        
        PID:5368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,5102308263983803191,10828577088203918510,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
        5⤵
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,12194883474745699151,10961622319231574432,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
        5⤵
        
        PID:3220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,4424341385925815184,695900624802359025,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
        5⤵
        
        PID:4540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,13881506795566093782,2761118006545730467,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
        5⤵
        
        PID:6552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6264,i,762876559291717381,6941968195753083086,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
        5⤵
        
        PID:6924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6924,i,9765130939132730669,128968093966168408,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
        5⤵
        
        PID:3984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6884,i,11064264260123610960,2604691388819806804,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
        5⤵
        
        PID:6652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,14100077545311166242,9735478520050387355,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
        5⤵
        
        PID:6940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3568250761873384956,5268641126278787339,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
        5⤵
        
        PID:6948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,6494000233884061374,4072785211104424762,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:8
        5⤵
        
        PID:6952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=2848,i,406109461587057003,3062571749705730969,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
        5⤵
        
        PID:6364
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7360,i,10444832974213607630,6694643101469232752,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
        5⤵
        
        PID:4472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7336,i,14317451670489175605,11173910595021835966,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
        5⤵
        
        PID:6700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6148,i,5590781198737084985,8537664387353178775,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:1
        5⤵
        
        PID:1496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,5680913860816277428,16304758536004631068,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
        5⤵
        
        PID:7060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7420,i,13925939053802503063,12796942327523462095,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:8
        5⤵
        
        PID:3468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7456,i,16883166021150855852,2249312759268002528,2097152 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
        5⤵
        
        PID:6336
    - - C:\Program Files\EZFN Launcher\EZFN Launcher.exe
        
        "C:\Program Files\EZFN Launcher\EZFN Launcher.exe" "ezfn://login/?accessToken=eg1~eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHAiOiJlemZuIiwic3ViIjoiZDQ4MDlmNmQ1MDRhNGRhZWEyMTE0ODBhOGQwNDliMmMiLCJtdmVyIjpmYWxzZSwiY2xpZCI6IjNiYTZlMGUyNDI4OTQ1NzNhNTQ2MjQ1NTkzN2NjYWZmIiwiZG4iOiJiYWxsc2Fja2VyMTIzIiwibWwiOiIiLCJhbSI6InBhc3N3b3JkIiwicGZwaWQiOiJwcm9kLWZuIiwic2lhIjoiNGU2NTZmNmU2OTc0NjUiLCJzZWMiOjEsImIiOmZhbHNlLCJjbHN2YyI6InByb2QtZm4iLCJ0IjoicyIsImljIjp0cnVlLCJleHAiOjE3ODI3OTkzMTUsImlhdCI6MTc4MjE5NDUxNSwianRpIjoiZmJjNzEzYWM0YzUzNGEzZjg4MzdjMWU4MjkxNWZhMzQiLCJkdmlkIjoiZjNlZGIyMGE4NjcyNGFlZTk3ZWYyMjJhZWE3Y2I1ZjYifQ.sG8T1FffwDJ_ovtMcU6SkutI2yUJVgnEeA4Ep7fbjSk&refreshToken=eg1~eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHAiOiJlemZuIiwic3ViIjoiZDQ4MDlmNmQ1MDRhNGRhZWEyMTE0ODBhOGQwNDliMmMiLCJtdmVyIjpmYWxzZSwiY2xpZCI6IjNiYTZlMGUyNDI4OTQ1NzNhNTQ2MjQ1NTkzN2NjYWZmIiwiZG4iOiJiYWxsc2Fja2VyMTIzIiwibWwiOiIiLCJhbSI6InBhc3N3b3JkIiwicGZwaWQiOiJwcm9kLWZuIiwic2lhIjoiNGU2NTZmNmU2OTc0NjUiLCJzZWMiOjEsImIiOmZhbHNlLCJjbHN2YyI6InByb2QtZm4iLCJ0IjoicyIsImljIjp0cnVlLCJleHAiOjE3ODI3OTkzMTUsImlhdCI6MTc4MjE5NDUxNSwianRpIjoiZmJjNzEzYWM0YzUzNGEzZjg4MzdjMWU4MjkxNWZhMzQiLCJkdmlkIjoiZjNlZGIyMGE4NjcyNGFlZTk3ZWYyMjJhZWE3Y2I1ZjYifQ.sG8T1FffwDJ_ovtMcU6SkutI2yUJVgnEeA4Ep7fbjSk"
        5⤵
        Executes dropped EXE
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,7174566199244363285,15420564049167493423,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
        5⤵
        
        PID:2000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,11613377523922700726,15537500219319979475,524288 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
        5⤵
        
        PID:5988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5132,i,14612458915888143638,8747186892815664554,262144 --field-trial-handle=2312,i,4940407401284452117,9718713628023729653,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
        5⤵
        
        PID:2732
- - C:\Windows\System32\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\EZFN Launcher-1.3.4-updater-qs02uG\EZFN Launcher_1.3.4_x64_en-US.msi" /passive /promptrestart AUTOLAUNCHAPP=True LAUNCHAPPARGS=""
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:6096

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2DC4DE9BC2E5589F5527DE4BE6864B91 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4056
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1736
- C:\Program Files\EZFN Launcher\EZFN Launcher.exe
  "C:\Program Files\EZFN Launcher\EZFN Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --no-proxy-server --lang=en-US --mojo-named-platform-channel-pipe=4484.4320.3774991074773245490
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    PID:540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffcd376b078,0x7ffcd376b084,0x7ffcd376b090
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1772,i,14621210040669636359,13771566479304765441,262144 --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2012,i,14621210040669636359,13771566479304765441,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:3
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1596,i,14621210040669636359,13771566479304765441,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:8
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3396,i,14621210040669636359,13771566479304765441,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4724,i,14621210040669636359,13771566479304765441,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
      4⤵
      PID:6440
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4768,i,14621210040669636359,13771566479304765441,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.ezfn\EBWebView" --webview-exe-name="EZFN Launcher.exe" --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4848,i,14621210040669636359,13771566479304765441,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
      4⤵
      PID:6716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ezfn.dev/account/login?redirectUri=ezfn%3A%2F%2Flogin&clientId=f833a7292b0f463ea38f9c1c0234a544
    3⤵
    PID:6300
- - C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe
    "C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe" verify -y --ezfnlauncher --app_version 7.40-CL-5046157 --base-path C:\Users\Admin\AppData\Local\EZFNLauncherV4\Fortnite\7.40-CL-5046157
    3⤵
    - Executes dropped EXE
    PID:3888
  - - C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe
      "C:\Users\Admin\AppData\Local\EZFNLauncherV4\EZInstaller.exe" verify -y --ezfnlauncher --app_version 7.40-CL-5046157 --base-path C:\Users\Admin\AppData\Local\EZFNLauncherV4\Fortnite\7.40-CL-5046157
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6228
- - C:\Windows\system32\cmd.exe
    "cmd" /C start com.epicgames.launcher://apps/Fortnite?action=update
    3⤵
    - Modifies registry class
    PID:4352

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e589fd6.rbs

Path C:\Config.Msi\e589fd6.rbs
Size 10KB
SHA256 79904b64af073ac285b6fbbcb7bde35817c55f5229a68a04d11fe836c75ea7eb
MD5 1ed633338df5705551ea22d04b5a5006
SHA1 9c411d8a66690885e9b6ed264735e4ce4ee47ff1
SHA512 539b65acf509036bda9a064b4fc67c22252812a6bfd678fb6476802f14caaa79b3a1fb0f7171c1fd328a65b23d1310bb100604267bd92b8c560a766fb7085b36
SSDEEP 192:oS0CeCSCQCfCNgCblzPeMeGPPeG7yGPPeT+7//iFLDWyi0/z/5hppSP:oUVRvaFoiMifjUrk
TLSH
T1A922FE42F20081D2ECD61B71E30727653FB3D7CA670A574705AEA9718F86B942FA81CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589fdd.rbs

Path C:\Config.Msi\e589fdd.rbs
Size 11KB
SHA256 2000e1c02b592bfe2895b0d6bd2fef6296a2b3978f37b675145380bec6fa9134
MD5 f86afb5f1b9015b69ed82432154c2197
SHA1 a498ae9149fe798837f29119cc942839370219eb
SHA512 1f6ef4e24d7d4e12f5bab1b84467c140e4f2d28861ba60a4c3f7cdbc40ce69e6c9688fd5dfcbb571281dca62b36a8e1852781c2634ea60b95ebf77312a057697
SSDEEP 192:RSkRWH/mVHR6H/m5L/qJ/n/MCu/Fpb5lNphn/NF/NX/NX/NRtX7tcBtJ/:RpR4aR8ySM5t3R5VtCtJ/
TLSH
T17132F143F20481D3EDD65B31E71727653FA3D7C9A30A875301AE65709E86B942FE81C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e589fe0.rbs

Path C:\Config.Msi\e589fe0.rbs
Size 10KB
SHA256 9586773b868998367c31ce6f5131c4347511d19ab298e92c9b24f188f45c82f7
MD5 6dd8a3ca43e9d00025b756008e424c57
SHA1 e12317f0c129a9f8e35b71dc28d18c01923c72f6
SHA512 add25bdc74f1038a28fc85fb775618f686c3e52eba384dad617a4c510657961ed227b7354d38ef3153387d9bf0b8c5c6621f8cac5927ce24269238644176ae42
SSDEEP 192:RrpV2SNbblJ3gJ8e8H8FGH8F9kGldjWCiJ2pCe:RrpV2SZ3wC8Y87oZe
TLSH
T1A0321F46A21592E2FDD31738C30713673FA3E788A31C560B09DD99369E4B3981F6919F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Launcher.exe

Path C:\Program Files\EZFN Launcher\EZFN Launcher.exe
Size 11.4MB
SHA256 3dd8c79514ac61b139d7236a9e760bf8ad4621519e72d78f3631c9a322a923c7
MD5 96d67208707f94c6780dee71fca3dc8f
SHA1 f4e93c415653eb1f055a8a3b207de3eaf0021580
SHA512 b3722d8802cccd8d63052a577607b32a48210135df7a353159cb8d53e7f4aaf73673c7d308bb557f978c9efb97e9a9643e8d78d4e47135c2ec1b5c596a28aa5e
SSDEEP 98304:afpRPMP+ImHjxdyD66ComQOBYM5FB46uIbvvnU1gwZuXbfbVSOS5naiNHT62ReMO:sYV9CVXbfbVUnf42RWg1Nsep8BLHPNM
TLSH
T197C6AE03F29181E8C0ADC478835BA637EB32BC8D4525B25F1BE44F612E66F60AF1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Launcher.exe

Path C:\Program Files\EZFN Launcher\EZFN Launcher.exe
Size 11.2MB
SHA256 92f9f381140e0d3be9fb2608378b2ef9a4067dd2b1b3ac4358c78f9479dee834
MD5 4902fee7ee561ee983b6a13e741ac954
SHA1 668730cca1889ac498c2ed9719fd4c8b9d8ee727
SHA512 5276c078088d9b7df8a46ae529cfbf50b11eb3d8706a5c9d9c45db10b76a903cd785716cc3064bf1f10d2fdcb19c0a659484ec38cf66e409a38a13c8b9c2d614
SSDEEP 98304:jEyuypPek13/mwDzxhDfzNO7ie8Et21bWeFMU6c3KT4104ssppXNEBRa62ReMnWH:jR/mCDFX8GaM13sepM2RHWG9xBxXEhD
TLSH
T13CC6AE03F69581E8C0ADC0B8835BA637EB32FC894525B25F5BE44B212F26F506F2D759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall EZFN Launcher.lnk

Path C:\Program Files\EZFN Launcher\Uninstall EZFN Launcher.lnk
Size 966B
SHA256 88de290f9cbbf715979b783ad62ff902f27152458d481341d36d4d0386381c6e
MD5 7557b1f2c2c17f23cf03644d4c7a6b92
SHA1 293aecb9c11a08ad2696b4af92cf65bdd4198308
SHA512 efa355ae18793be611c74da99f5be89f3233ff89a6300fd73032fe2cdbea82f0124293d5e957ec964a1fd01c972981964a2ddf31c65d72250399b9d98d3de81d
TLSH
T1F111B1410AE317A7D2F29E3AC46F93168AA6F80658939F1E4006D5C70845582FD7AF3B
MD5 SHA1 SHA512 TLSH

Submit Download

default_skin.png

Path C:\Program Files\EZFN Launcher\_up_\public\default_skin.png
Size 8KB
SHA256 6fb348720bff52358ef5410fdc50f1b05816fdf69ee46a8c90e644dab7292ae5
MD5 97eb02c682769364d8d31ff17ce9dcd1
SHA1 5ea741681159ad2420ae16059eaf02d5247bfa96
SHA512 fbfdcccbf084456a89f7498af53449238e84016c6812bda763ad6d576891131a6f8efa5ed107de835c07a201f6a501bbdfe6cafac82176d74efe139a0db1d892
SSDEEP 192:Q5IpKm8ISv+avGtQUgEk+lDoHQNP3zW3nMt:Q5IpKmkBOSiPoHQRzp
TLSH
T13802AEF65A44DF38D65EE87B228BC29CE73A43D1B1A53B349DC9CC6942649E91A384C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1640_1348575350\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1640_1616986765\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1640_1840548668\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

EZFN Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk
Size 2KB
SHA256 7fc6e990f0833f6e26e494d60fe231aa9c89f71d24c3673d5486b0967cf3828a
MD5 bc906ce7e9ab6376e5665724d1580240
SHA1 5e6f99710b17b471b798eb7fc6176d409d0c74b3
SHA512 5c36614cf0fb2fef444526a47bf20d7139a2d1037a6398b4f82139ff07007ec7950e4a17da207d61824cc56bb6d68f17e9314d5bc1d762e30c13b45993512864
TLSH
T1FE41B1200BE516ADF7728F35593296119B77FD16F5348F2E40C5D1824978440EF6AF3A
MD5 SHA1 SHA512 TLSH

Submit Download

EZFN Launcher.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk
Size 1KB
SHA256 edbcb8af738d70e032cf3a1c0e39fe72ab8bdb1318c832f1380305657ed98a4e
MD5 eb4fe92b6fe79c3cec4ee7f8a5b06b2d
SHA1 17eccc422374c73b8e9bf84612373e02ce3b1df8
SHA512 b4a2b0984c251275d0ec0ec8a515fbc71ff87d23c64c4e76324ab01e7a4ea8c4d6e89f4d31f1e142b18f10884c7e954a16c9532ff5f9d97d6c6474769e22a829
TLSH
T15141AB240BE916AEE7728F34593286119B77FD12A5748F2E40C5D28249A9440EF6AF3A
MD5 SHA1 SHA512 TLSH

Submit Download

EZFN Launcher.lnk~RFe58a236.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\EZFN Launcher.lnk~RFe58a236.TMP
Size 1KB
SHA256 612a80a21504c882761be0f09f90cc2a92ff609bc3c19c1ce3f354f59aebd9bf
MD5 b4321b9a03b7ceac9d089f1bdc7a9410
SHA1 af7f2fc2c6e33b225954ba1061e5a5ad30a61ad7
SHA512 9c299abe546727cc29c4cbc0a64ac04606cc3d7aec1050437046c989fd22143e3465801d6dd818fd13e60e8ad16570924b3138c1d5f723a7bf9708e69578129a
TLSH
T1A04188201BE5275EE3728F35993287129F73FC06B6748E1E4096D182057A501EE78F3E
MD5 SHA1 SHA512 TLSH

Submit Download

~ZFN Launcher.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZFN Launcher\~ZFN Launcher.tmp
Size 2KB
SHA256 1463aa4d1cfb2ade7869a24b5200f3024a1290f811ff94e065a9b0c8e242e4c0
MD5 bbaa5e1797bc24df19d776e3ec16c0cd
SHA1 e98f9070b3bd8001cd81282adc2f266a6285151b
SHA512 4e2e174a040cebd0eb211032064646994db49a753dff9938fbee59c5d58ff16647f1457760ca627aa868b9255ea7b28327bc445819e6015e686b61d565cede5c
TLSH
T10A4178201BE5675DE3728B35993286129B72FC06B6748E1E408AD182096A400AA78F3E
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 36KB
SHA256 468d56b6b25b05b70190b6c233d773f6f1770e8579827ce022a57f03fa8002fb
MD5 d4c68940b772538be3593f0c646de4a0
SHA1 780cf59b7711cee0db291f06922ca66b12b65dcf
SHA512 9ef888244841c65da84ab26fee2d312bf0410e340df78b10f087c00e6f190cf8abd61cb09e5790dfd7270edaac1bbb7f871031b195a7b2363f389b6be0038e89
SSDEEP 768:HLi1ptmFif/WvZWPAD1lDB55/hMWS/CtVkvIP0t8eY:HLktmFif/WYPe1lod6fkvfueY
TLSH
T1D1F2F1730F45F63229562EB8FD398B4E772845856EC18EC68D90A8F8F403F646469A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 159KB
SHA256 045bc2b85a8c56fb6b98d90c40a5050c5a39972b3ccb712fb325051149082d1e
MD5 d42b1b559e28764a0d53752228ffcd6f
SHA1 e29548bdcb70e941ca2d886370974a5fc7a80d6d
SHA512 5888ee20751bdf68dfd514d9e696b2ffbe73810955b32f8562919abf882eba2f4816c9c68c6512f4e06e72992e065ceb7eb8747a786d014f7ce5ae211e96308b
SSDEEP 3072:w62c4bjgwxBiwksrcMqSU8G217qfb/7BUu2NXag3JeXHcrXxO+fzl:wXcrvwksrRU8nW/dYYoe3crBO4zl
TLSH
T1F8F3223EBA5C3218F26972796F04D8B0615DB37301A3E4598C9F4D233E5CA19C97EA1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 24KB
SHA256 0a19a8174b6942a0e3f6eeacfc3807be6ff0932eff84016d8f2b58f2aca70b7f
MD5 b5a7677bae06b7d37f3202311849a39f
SHA1 58c8a72b881192a0105f1fb15c79fb8d44b8f878
SHA512 d8ccd31354635cd4fc38e115e22bb1f85957fffae5c4111f40d2afc0c37da7a98433e05401aeb5545c1fccd18bf39aa2236c8acef10f09933eb840b163333b81
SSDEEP 768:Uqwuru945u5X2uPA21T+6q66o+/uJKCf7nnpWGC0G:3u9QEXV1T+6KGJJwGC0G
TLSH
T1F0B2E15919EDF8E7EFE396D6809384558278DCCE1330789F80499DAA73243913C24AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9384b46a4c0d412bec49ae5dfede1a06e146745aa99531915ae34e3b37847fea
MD5 1b68e1e12a055720e8b7cd165a0be358
SHA1 6a1a7558fc822bed481e5865b0263bd1a7a599ee
SHA512 9fa6690457f596e0ea2ec91e0782be77de28cf414876fc6da487b1020963784b572596a13eaa67bc157effd12817b19243b60ab4bf62b89c981a879f2fc3adb8
SSDEEP 96:rODWUBNW42xIV1KpvXxHJTae7qhEFNcn3uN:rODWUv2+Vk3T/7MEFieN
TLSH
T11B91853F0293383DEB502631C9DD0A05FAB9C8820DFF5E16F195B57C8AA335265E6838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8c65fed307d85d1a08d98e0119d0d7679db9a3811368fb779305eb588c2694d1
MD5 9c019343ca80e5bd6163e97e45865e07
SHA1 1907e2f3820ce40cc85fcd675e7399f92e234e28
SHA512 f1796036e830289eadf22a7f59443f6d9e61ffe3a4ab75402a9d3edffec5c4f280a1de423d11566d505ff4b372795aae91b8f289c2326dc9312de06e6dec1db7
SSDEEP 48:MWEp+DyRKGbuwxFq4NCjaZgJxIgSIO6S85aWM/vawwCfvmKShFqxkTd3TW482Ran:pDFMDS42xIdlsdCX1K3TF8qSE28u9
TLSH
T11681943E0193383DEB502231CDED0A05FAB5C8864DFFAE06F185B57C869335245E6838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe596dd3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596dd3.TMP
Size 3KB
SHA256 a7b12b1a2330b5b898c8997ffd2c9d702152f06068bfb7c1cfc6cdbdc8fd9e26
MD5 1329efbcecbe5259d5146f5c1f94b31a
SHA1 f9632d044dbbbac48388342a9fad35bb51a13a7f
SHA512 3d5c443f05bdadc66e5b3c0b5f8f1c4aa3432aed1ec60b7ff8715f3849cca9dc9a9c1a9de769812a646831e7e238614aacfa1dae52f261f94d17bc95bbd5b60b
TLSH
T15A713D7F0293307ED7612231CDDD1A05F9B5C88549FF9D0AF146B57C86A375285EA818
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 8ccfed75bc41eec0bfc2895260a7615e867f89c17b71e42654471681d47f599a
MD5 91d29d508ae6509dbded9d8cb7c2741a
SHA1 4aa3eddf58d61791f011c66c10bef06381566457
SHA512 4a1f6f74900a3330526f4f769d0edac54751a61790d1ba8b9344d39780100ec754b6baf20844140e8c4205910463f0e91fe884578273fd0835e19bdadb080227
SSDEEP 192:D9spg9pJqZl5c3JOJ2h917mGj6Qif40+lqK3ZUEGese+VUl2PZzszPvZPiO:D9spg9XqZl5cZOJ2h917mGGQif40+lqG
TLSH
T18702EEF7C7E8866ED81152F1AB583E2BDE2E1984432C3D4AC5E4DF4B93E1470E24295E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c2c5b5e62730f124709910bb5e0767ea093ba052b986513fb7a684a52f7fe481
MD5 b016078975b7f7796a853c22a576c042
SHA1 4fc988299b662172b7147c111ca5c875b3d4c9a0
SHA512 3f8590e9312df615e67204463341051d06b4ccdc82f2940bc4dbbae591ba257a3a6ceeab81a2a037e2fd064f36a83bfcd94a43307550fc94c1c95f854251b53e
SSDEEP 192:sxZ7RGyM/jK1Ml8Mjx/fzsKtTEdpZEyHW6+WNuSIf/+3p+wBu+PIg4J:sxZ7s7x/fzsKtgayHbJ4/+5Eyc
TLSH
T1FA52EA026A34597BCCDBD219FA55BB53D6F50562A2900E489AFCCA0C05E6EED6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 83223257873b890e393d695879d6a34f6607963876eacbbdcb9f4f657e676770
MD5 3c5f21e40d0b842f20a31f9a0663bb55
SHA1 ed431749bdd21718ae4acda749074e362d3ec6cb
SHA512 fc5c99764728370fc290fe0496fb9f0bc4155a315a717b5c99f778b18a3a68471731d1a2e4d6410757f86f56fecc69f14e04960e8b20af064b366123c5975d5f
SSDEEP 192:sxZ7RGyMojK1Ml8Mjx/fzszPYzmO9PIdpHoHW6+WNuFhPzBSNErtHA3owMTu+PIG:sxZ777x/fzszPimAgIHb2P0xyX
TLSH
T16A62FA57AA34497B8CDBD219F551BB53D6F50572A2940E84EAFCCA0C00E6EED6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0a19cd3177962310b933832f5b76534777f82d00e17e95a47d697df90794b1d4
MD5 821c503934d84b8c62f074ca7e9184dd
SHA1 c36c1d91e91e4fe64f64a7af262e805cd0fe9628
SHA512 9aa19a36eb3ea5a287509875fc78bc7092ae671bbd92dec3e5a5be12c0b0f1f496814e96df90529a2ae95afb032edf1b6732d1a9b6fb6ff4771446aaf4235f05
SSDEEP 192:sxZ7RGyMojK1Ml8UQdjx/fzszPYzmO9PIdpHoHW6+WNuFhPzBSNErtHA3owMju+f:sxZ77q5x/fzszPimAgIHb2P0byX
TLSH
T19A62EA57AA34497B8CDBD219F551BB53D6F50572A2941E84EAFCCA0C00E6EED6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6be383d19770a8135ca7be054a069ba818c27230c5c12098a414ffe5a3abe063
MD5 36b73a7b618109a4d90352e8ebb8397e
SHA1 b82ea8e19e0906696d2a1f297dd3b594831130b2
SHA512 59c5f63376ddb08337801f18fd6775b8cfd38c34704722f516f7645f6ebf6fefe3520ed9a0b1c29506bf285167fd3822329f2ba8eda243eae164bd9d0e562e80
SSDEEP 768:Wj4jeWmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVePLlrZ+dJrohSc7aU:Wj4jeWmWvmKLEu1jaRPLZQdij7
TLSH
T12DE2FA3B280CCF7E4F844E5CED2AAE976DD801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9fecdad4c765436551f1c06cf0f80aa398b5b13d305924f2eac2719bad7b3402
MD5 2a8807ab21fc581222be278d3b81db54
SHA1 309f8a7cacd942e3c39732ce29cb9a2b58c81b82
SHA512 9b14cb8f9c828b0116354fef2a9071324af2f1acad605361341c5291c82d086b313003056bcacee042406ce2dba5cf7c2f4c18a83f8d5bf140468b1e3961f838
SSDEEP 24:KdKf9G3asdAc44o0+rIji4KibhaU41EioSmWM/8qVyXY+pf+E+v+Wa+zd+b+X+fw:KQLIhK0IMnyNbI1Kc04IQITKlisjyC
TLSH
T13A91890532FB23033C7E7424A1A19B6B178575733059A82B3B5810F68DABE624DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c29a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c29a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 88c94f589f94f982f438e8ccc8f17eccd1a12834a853d643f05e6e2eb7c0141f
MD5 4778277f04a9c9077e3f0af6d942dc5c
SHA1 5a4f5fde11cb1da031f5380891a2a543e583e475
SHA512 6f9b7513dd011a153f69c3f4504e94b92a4332aace23c8ecb52bc0bd53c281c2effb34824f009f5a490c5c3d758e46834430c4bd2d22c3558e705de4164f69ee
SSDEEP 384:naiFKtNn/s3n9SYzsNx8TUNTUlIlf5bh9h/brDf4x+5OMYHo5etFSITGT0I1x9N:RFKj+978wg3h7sxkOPo5eHSi+0EvN
TLSH
T198C23B32D864DE6BADE287D6F60A76479EF001A785C96EC5D9DC2E4C00CB6ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8679091d97404f6a31b1507cb8c90bdcfd8852725d62a39ec1823c5f1a39fad2
MD5 21197f138a8607f4e2d0282b6dd79e44
SHA1 6bbda59b0e64e1d58b0273182eb68cbc48dbf66f
SHA512 1a5d70199e6f9aac7c7d83451836e0acdc1c487751a15f3dcf1315454d0fe10f919718dad2992c4a8482b643045a75b0c5cbc758ecae47c4c35c52ea3f9bf7ad
SSDEEP 384:natNn/s3n9SgsNQUG5bh93kvf+5OMYHo5eXFSITGT0I1x9N:aj+9bBhmnkOPo5e1Si+0EvN
TLSH
T16F926B326938AC675DE29556F40A36170FF841ABA6C53FC5E9EC2F0C04DE6AC135AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 13fa618677257ad9dfb00fb16a7cb7c1c3a2a62c1ce4901e56d1d559b10ba4ec
MD5 91d794523b805660b2793ccce7b42493
SHA1 d611ef0a951e5d7f5b4a473d49e97994031adc35
SHA512 1d6593151435b4861d064e102435c0100d5ff1e9831a6b5c3c1e83d2f0f72e42428cb28d2addd5ddb355496fdfc44833a7a74c60bc743ff1fe3deee4bb8c4029
SSDEEP 192:EONU6hZ0QmiUy+gpc/+jVnO1GYc5wOZILU6:EONU6oCpu+5OMYj2uU6
TLSH
T18002E9356C686C778EE2AE46F48777235FE4112BE9D56F84EAE81B1C00C769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ed68fdeab7af6f4a89bedd8a74730ed65f5e33dd732ac0a90078d1e85f1fc35
MD5 14664e81151b29adaf20aed5dbf9c4a9
SHA1 feafb1edd6f12041aa0c4f56b0b657615bf9b50a
SHA512 63e91689ba3bcda727610d17012286b24384de7a0ffd027ebe60128d5db03ecde462e3b606a08526f7528ebac794e87b5361065841cd8eb453b70acddeaba5c9
SSDEEP 192:xONy6hZQQmiUyXgtc/+jVnO1GYHLE5ej5cOqErqEU6:xONy6cZtu+5OMYHo5ee9SU6
TLSH
T109120B326878AC674DE2A941F48736135FE5512BEA857FC5E6DC2B1C04DF6AC230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4f5d6c419328b50af02dc55a9e59d5c3ab0de1de2411a49ab798ca9b0c6650de
MD5 78124575c9d9b530cb02c670d75c3ba8
SHA1 288bb66e5cf81866ffff96cd5ae4f8fef818f72d
SHA512 ad29f02a32b3d1c6e5281b8694f600affdd19c2c558bb507d0376347b626bddc164c35df93e199da64ac987ba38adf6646de6fdb11ad4a458fe74b9798dac681
SSDEEP 384:ngtNn/s3n9SgsNQUf5bh93Aw2f+5OMYHo5enFSITGT0I1x9N:gj+9bOhOwmkOPo5eFSi+0EvN
TLSH
T1CE926B325938AC675DD29596F50A32075FF441ABA6C53FC5E9EC2F0D04CE7AC231AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d7cb5b40c4c7d9053862a293dc4ab08a5899e6ec1ed2ae2a619fe010b5c3fcd7
MD5 f810f0b9daca6bd66007780e2f60c5c6
SHA1 c9c38c5c2285833db77285dcf47c3d7cf6876c78
SHA512 a53037b3a7a7843b642ec29c05a0d51f5823ed44777180aae633327d16f59f5b5b003c9fadc256255470892d1ade776872b66e3b50bc0eccafd561250f05e390
SSDEEP 384:ngtNn/s3n9SPsNQUf5bh93Aw2f+5OMYHo5enFSITGT0I1x9N:gj+9UOhOwmkOPo5eFSi+0EvN
TLSH
T16F926B325938AC675DD2A596F50A32075FF441ABA6C53FC5E9EC2F0D04CE7AC231AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 097e9eccb2c890f2ce1aa6e950917be3436dfc1e69bd057af0bf540d7842754e
MD5 03e4c42cc6f521d40b22eaae1b85c206
SHA1 3989314bd34e72ffd2a6266af08f1cbf8a793421
SHA512 78480af058c45c69345820199d739d8fd77a2867b6d76bba38715c7173f9f993b9e8659f7819688322a3aaf0ce8a6a4d1934133d8f9f92eaa96a671523fe860a
SSDEEP 384:naiFjtNn/s3n9SYHsNS8TUNTUlIlf5bh9hTbrifhx+5OMYHo5e3FSITGT0I1x9N:RFjj+9/Jwg3hfIxkOPo5eVSi+0EvN
TLSH
T12DD2A4F298D79937D89E4783A73E6E464EBCC153B5885984B7D81E4CCC862BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

83723f64-a000-4763-96ed-3a50e6c613cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\83723f64-a000-4763-96ed-3a50e6c613cc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 10f94b861d491f9c0d817546f2e45292f132612e4b224f6673a7caf77887d741
MD5 362703b5dc4ab1275366efa1f33aad9a
SHA1 64037f591278f328e8dcfb5740343105b1d25e70
SHA512 19bec7e051532512e4fc45e27f709a514a4a127a11593efaea4687e82b508c12a16b6321bc2bf52e66d4ea6b4a90a5e8058acd04e8744fb511d56b56202a93e9
TLSH
T1B341FA58AAED1148B3B36E56AFF6E47D487ABD772E16D45D00110D4F0B66B40C872B33
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 90c244a9dfcd6df454041c6672531c24f3460ebe6d68dbcc92eadd6511af3c03
MD5 bf6957980c55dcc4509f5291ee9f64d7
SHA1 3488fa6f58577d3f87a5a28381658ba220858cd1
SHA512 8e756b7c75d522cd9cafa6c8df0172de2c329a981411ccca3317468bbb6b4257b410f80f2b2e837ee2e6cafb3a3d71167d3b90bd7ca6f54c94b1a98fb70d6727
TLSH
T18541EB99A6E91148B3B76E5AAFF6586D847FBC372F07D05D10110E4F0A67B00C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

33935c5c-f032-49f7-9166-9ed21f1b0fc9.tmp

Path C:\Users\Admin\AppData\Local\Temp\33935c5c-f032-49f7-9166-9ed21f1b0fc9.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EZFN Launcher_1.3.4_x64_en-US.msi

Path C:\Users\Admin\AppData\Local\Temp\EZFN Launcher-1.3.4-updater-qs02uG\EZFN Launcher_1.3.4_x64_en-US.msi
Size 7.3MB
SHA256 40b73a8262bea73752af301e48eb2950e26478d89194347f35c7c76e5dd4d9b2
MD5 eb608b6b6a987c3e23214a31892dc854
SHA1 19b52dcf000303447d398e1c6e1f54180fe07722
SHA512 832ad674f42c39af3956d2cd0b068d379d017a4bbab120b03677c4cbaf828635a93277a6ffad17d9e080f0057f5e2d4a7bd8fb80ec26fee527d0159864eb7710
SSDEEP 196608:SeejhQ74682AxhGCR2qRmTTf1kTjNUK/5Pk2m8NG:J4hx6BAvGCMqkXaPWKBPk2LN
TLSH
T18776330F3E494E22E0A91DB1053E9B10973EAC405B39A8973242775FFEF16C25A79CE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5E77.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5E77.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6d80672-3c26-4dd2-aa1b-3105a24666df.tmp

Path C:\Users\Admin\AppData\Local\Temp\e6d80672-3c26-4dd2-aa1b-3105a24666df.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1640_1883862327\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08de2270-c0d6-4bab-8277-c03b6d4996cb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1640_984719500\08de2270-c0d6-4bab-8277-c03b6d4996cb.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b39725978d3d1d55a2d003129a3a86044fc9b09809f62479e7f7494e0fecf269
MD5 737db5dee8fbd798dcf45d9469e5eccc
SHA1 80234a46c1c4903ef86f5288c0ea82b5252ba43b
SHA512 6c08b445508e00aa0721273591146099ef53f796f94c5c41857cbe87c2ddf9a561acfcf0081644885b859cc307ff1b846762ac3a2be8e053c4629eb22aadbe93
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 838a60a1ed10978b215d71d58dd3049a011d85e6fd2c9dcc03409e9c8055e680
MD5 242402cbafb9f1caf2c60a0e271967d3
SHA1 9efe14ce6cf8c73a0e965bc69b7cb099828f5bdc
SHA512 8e66f746d20a37fe4265c1acdfe8c995f91a62defbbdd6fbfa09580032cf388e4be54246aeee60aad608875234b1f79f420bb407717366af2c7f83232a527373
TLSH
T158D0121332110534C41020331686660C1400CF0B44068044542C961D1B840600A02452
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d58f06cb43d99d4ed66a86197a243ce851c3e823a84b445c89262e9ebbeb9b89
MD5 67a77fab4a170795fd2681e911c13143
SHA1 99bffacca6b85b360da465d014234f56afdcfe90
SHA512 442cefd310fb2307d04055f00964fe0bca292578055c771184a38e74b8ee78b85c95cda4925fa30773a0e6c9a0f9ba282ae069de4527f63c0297c6acb379091a
SSDEEP 3:MsFlYhXllLlX8lPePf+dl/U:/Fiz10vn/
TLSH
T1AC13022CEBC74916E905447849578B70E3B1E6875E5653D360A1B665ACCA7084D14028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 9726e855471e08f6fec6c77a093d70fdbda61ea8d90b2e9e7af89b111350043c
MD5 5be9ed39777468e865519e4f1d70553a
SHA1 5c7204977c072db0261e48061e7b300ecea62418
SHA512 579a8cadede3eec119ec4b78939ac7909664e8a25ae262a5ae99078d4765bedfdb05ba64ed078777a73a9b2f46ba061664b9e4e9f45333cc7ad82a31364c5e19
SSDEEP 12:U/UEEg1SkELq6k06krKth7Vd+zkifpcB2TRqsS:1Qth5d+zkifpcYTRa
TLSH
T107442BAFBF2AE24BC23000F95888992CE3238466AA58F747F3C020140CC2B3C0C20189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 66b4335c83f6ec15578f9d597ce441452fb17d20d9222062424cdf1d0f75fa5d
MD5 6820ae0bef093c2ec9a7fd37bd255522
SHA1 a4618ee617edecf0fe8472af933301d97337b128
SHA512 d604cbd5ce36cff135a8f96c79083291976c9f6bb43d4781f972d22e6675642855d69879c4825e119e8a8fd17a3c68dbeb45dfdc51b20ef563593de02309fa7e
SSDEEP 48:LoESRYXq9+CNzrgW1xO8ExqbiG8mEAqIFclV3jJgxOqSlHw+sqbsH:Gu6rNTOgbi/RAqI+l+OqS6zR
TLSH
T12725D8DA9B749A92CBA6ED74BDC5C86E7DB820876EC570436242C93610C3BC11E2215D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 0b7ed29a1e7184acc24f431fb07497ca012a05e8f3d8b8ccb8bad820632b6e50
MD5 bc7e5d0c3ed37c7aeb2b5b1d63427bea
SHA1 4b3902f4bb6f0b007a892f3f46fc81649748986e
SHA512 b22d2e5caf1423ab8baec205a1bb3c790be06a2c4ab38868b2a940fa7212da507fe311645e65d2b8a9f5b71e23713d81cc43bfc97957c4cfedd7cbc77793c755
SSDEEP 3:LstlXllllklkXlItXMlNnMNtl:LsXplP+XkmN
TLSH
T12C44043D0357440FC541137C4DF5C3341334C434470F4343511501301C41FD44F05041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 74980cf8783352c0aeddc444bef90a3f290366e2db80c1edb5c0fb5accec0d98
MD5 200024a54623f750f86e5fd547671e03
SHA1 ce42e30c1297ad1160e08eb1043e572cf253aeb5
SHA512 5e2fa9d004584b2cc43aaf5300b00829260306e3aa47b0c579a464c0e1c2c36ec050a84207d6fc2f10b0a9e1c1de6513dc67074ee5208e624f10d3bd35c5416f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c57985055490948b593336362b7072e237f15e01a58cf0d920992d7aeec95a60
MD5 27f199de508696f39f2f2b084d85fca6
SHA1 45d3c4d7842bd7ee4e3be01d20970b80f3ca73c1
SHA512 fa1ba6421acb1af01c096cebaa13df6070458cd379a25498631d4c8a0127d149be52f6d321ccd98d6df0d434d72a24bed8f5c4c368120a99b1e909b820e40bfb
TLSH
T1832122F07EE3EA10FF1DAEB498768CA61BC611C1DE14279FFAD411161A1B1C4B251276
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cookies-journal

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Cookies-journal
Size 8KB
SHA256 7d2cf7cbbe8ed79872ff1a5efde347dadec1711a83a45ae1b4eca3d2c94c1db1
MD5 206a4de9e1272fa985857941b972d450
SHA1 a363f9cb17446172bd28c1ef1cd7ebbfa862603f
SHA512 7278226c94da3ccbd75fc1e6a9558a6eaa9b18ff626b85b92fe0aca157146805a6d76ba8f969b22c2058c125c33982ee0bde2d76fa60b4187f3f4b059d6285e2
SSDEEP 3:X1llg93ll2/fll31ll+/Nll3X:Fllg9Cll+h
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Network Persistent State
Size 601B
SHA256 fa1f4bb8d53fd78338c4d7a45fc6c509198915bad749a7b4411b9fc1e0113ee0
MD5 df3223b0ee77cc8930261caab9de12d3
SHA1 050336beb5fc69284ee1c3eb47c1f3b91715e4c5
SHA512 04f54dcbd22fea8e85081c3eeadb954d4ddb66e42bc7c9b0ff7e5b38970f3e598c913a1fb2491bb6a77bf45b2892a8a8704918b7fd8a55a094dedddd61eb2e1d
TLSH
T174F0ACB2D6D486BE8A661BF81A20381BCB2E080C46B83D19C7E4AB978BD1535D11510A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 677ea2d8ed93c4a35e23c1bf57f1a2361e574ef8f2ac0db5cc259f81a774589c
MD5 7097d53e054909851ff1be63c6117dae
SHA1 1342b8054189b0c8de2fd4bd64b8db62a4749f54
SHA512 6abc2eb2eaba466e3103aa11cb261454500788a0c7587006b5cf8a16c14dc4a343e9b4cbedfb6a2c2739d41a178effa07094566ffe53a896827dc7126df488be
TLSH
T17941ACB7C6E8866EC82616F92660381BCF1D0C1C46BD3D1E89E5EFDB9BD1431E21560E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Network Persistent State
Size 601B
SHA256 24162aa183c52b0ec46f9ab10f1f94c6a0da537ffb6b845f050863ea6b3756a7
MD5 f51d81dd7117ce76c1bcb5f248e62b04
SHA1 8963c603faea06f4fa0a74fde7f13bcad8bc6f3f
SHA512 3602fe048297f9f4c5da8aea783dcb6b6eed38aaf26e113900c4395b929246c982a77678ddd4e3b2f64558e799dbe3b95f992552e54361269759307db8a5536f
TLSH
T19BF0ACF2DAD485BE895A16E81A21381BCA1E080806B83C19C6E4AB9B4BD1939C11510E
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 85861dcd491dac0cc887a9a119f133924aaaec93d66dc0bc22b4bd9394165709
MD5 e93c024ab1b5b595ccc29ac2547ed21f
SHA1 d26231e782340829f75298c1cb1a3cbdbb737aa8
SHA512 edea2ea29f2f847fcff1762fe48d15a9d3fd78c8d5bf04604e19569ab5b2325d91e0c1efda533bd41aae9b5f675120821fae1203cde504bb081bffd923d73871
SSDEEP 48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBXed:uIEumQv8m1ccnvS6Oky
TLSH
T1B3F214EE4B9D7605C4F464B8D9C00DCBBE5D041D8FE6AEC85BE906E3BF816B1A438055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Reporting and NEL-journal

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Reporting and NEL-journal
Size 24KB
SHA256 930b24b4cb2ccd2a5db932061c8fb2727a16520e13ac9b512d3a747a5aaa2019
MD5 028aec4c531f741eae876867e90eb0c2
SHA1 f03d3ea0af7c9a7197cf5207b8b007b07a3da5f8
SHA512 64d61d55f9b9b3f4577415417fce9ccf9201d0ac14c7a74984f77d2764a44d43335f9102886a4915b13297575cd273f7042bba92f9c09c077084006259d4b60a
SSDEEP 48:xFvqUUCeqaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNx:zC9/bIEumQv8m1ccnvzn
TLSH
T1C8B202EE4B997604C4F464B9D9C00DCBB95D041D8FE6AEDC5BE906E3FF81AB2A434054
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\TransportSecurity
Size 186B
SHA256 bd88a3ed5b6af3a8088d5e4341a3d89754d85b68cb7c4fd2a977a0385a0712ff
MD5 06ccf6befc6a70b486ec011299b023d4
SHA1 3986f54fab6567191c64d41c19d8cbe5896e7ed8
SHA512 0a807ddec7de73f82f8e5f5193b398173daa0fe73a79d1fbe2636539d6464f12eca20b35bdf75d852d097d0b061599985184dbd8fe4665b898b83a1b157c11d0
TLSH
T11CC0C07A407FE83220380F213CC4BD029F76F034014298FCA1C2023DA09007B530B093
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 68b8e2437a60187d2f2e9ba5ae306d594d920eb2a200157f688d688a83517536
MD5 cc241f288ec3bde625979b4f648e70a3
SHA1 bfbf7027c5fe8a2baab071b9f391593f5b194e2b
SHA512 54ddf392ff77dddbb25f01f02363e4f82b989701afa2ed5817fdd1db368c0b0ddada9d152f8280b0e9a9ce9d85c6cd25488583bf9e6d65b3fa7fd6673e0517cb
TLSH
T1F2C022A2407DA536202805218880BD00AE37E0340142DCF892A2062CE08006A651B403
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 4d1a763e4bb191c29596ab4657fafb243afb3a777df9db098d1784967c6fcf55
MD5 55f9fc389a0e84b5d730fcbd08122db6
SHA1 2fb6ea5c0a19f2b239fb3552a365b06836909989
SHA512 e71b518025d4020e6ce1a72736e1d8128a05e77fb5f853ee5c4eefcd85f25ea9ca6943c3c7d4aee794af1556c0c7bb25f891aba562a14bd953dcf601791611c2
TLSH
T12BC022A2813EA0323038056109C06E099F36B034128268FCC1920238B0202766217003
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\TransportSecurity
Size 186B
SHA256 16eef021583f32320e981eafe2891e7e3a885c1bca9553942e60ffbba60324b4
MD5 ad91159ac271cf0efd1cc87da29712c9
SHA1 13eec0d675ad763788d91dc6fe6cf97a6d0a464e
SHA512 53a80b1e6c739ee545795370a1401e18abbf6eef739b92a14e6f6ab74fd52ebd9a0bda536038b27164f6f0b5ef61620b5b6143e65bfdb4a633b3b16b1cca6856
TLSH
T114C0C0B2813FE8321038052508C0BE019F3EF038014278EBD5C3063DB00027BD20F003
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 d772e24f4fbec8a21439ffb57c335e6f2c945dd9f70fb56e5a84115e752e3797
MD5 d59c2d0f794872da30b2170ff414b3a3
SHA1 a8a18552f4e7a48ad2b5373176b67818744feae9
SHA512 057f2ee470e79ba6aa5129ae716d18f28f737c0e651be1c52fed0db19075dbdaee09e3f7d3b7ee779dc73cdc51cf72a6d70ec22cafa6e5520dca46dfda9c0659
SSDEEP 24:TL6EeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TGEeWOT/nDtX5nDOvyKDhU1cSB
TLSH
T141F29A4BE93C6FA3CCC56FF08B07D5B41F722BCAE68276C4247120A01DA964495E7447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Trust Tokens-journal

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Network\Trust Tokens-journal
Size 4KB
SHA256 1899714e80bf92c5c35a682a97de07e0cbd9d27c5067dca8a531e41596eaa7ca
MD5 8fda27a48a8e1a63e5007cffde2c2010
SHA1 03e8c80009f3f37a42055adb9e12a9fefc310112
SHA512 41fd55f4aef55749e6c62e1cb371823e0d50c0eab2088b61aa999c1c3ca8b4e5486fd8d3de4df5127150fd07aa70162f9f4d52601168004a045946e7ac360319
SSDEEP 24:0PqL33lIIAoDJ84l5lDlnDMlRlyKDtM6Uw1:cqL31DtX5nDOvyKDhUy
TLSH
T15E91035BE93C2F83CCC16FF08B07E5651F792BDAE28272C5247230A10DACA0165E7543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 798922eab9e0120d14270c41e2a8fa4a4a02ee03148d94879b7b8973ab2d53a2
MD5 960de9ee233f617f9e4a613df29dd01d
SHA1 e04c91edf5c89e218063eca71e9f3a78b5e5fbb0
SHA512 bb193dc0b190c93b50540a899999cf4bd393d6fc7ad6fc19cba93cccb12d3e1a608932fff5ec80e3c43651f343869c81cae31ae4f420a4b1d0ee55cff867ac1b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 1KB
SHA256 a389eaa0f9b9fa595960b6cec5ea82329b7bfc59d490bf3f7f154827bad6f6b0
MD5 8a5483e40e3b5b5d1949cc182819b27b
SHA1 643aedd7e93995ad7821e88f2004447d4a5bd7c5
SHA512 b36b5993e465f3be6b734327f3d6758257aee174cf4b18cfde0c967834a8d932380f8a87de52698c6e503f8fc85a9cb508a93d8f392dc0d8f8dcc2a064b5ee80
TLSH
T1BC318573E4E06B33589265A17145BA673E204076C3A19F88F6DE4B0C22D6ADCE52AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 2KB
SHA256 fe210be5ff125ccefc4f1cf32541a9305d00031e0e3b63c7229395168938ec99
MD5 176367f2bb6c672bf7c75e829d8c025a
SHA1 91546f4e15e903cab3796e959119d2b14f962f89
SHA512 0c343c5405e506764ed080423d6b4cb35eba84013f16e0ef9a80d9f311e1a1cfc9ee39ba56423a656d09a93a86daa9867118f4d59472316a9f45ac2a0e9ee56c
TLSH
T18151C773A854AB3789E35550B9857F23BA3141B197A22F94E9DD0B0C11DBADCA306C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 3KB
SHA256 a019ca687ffdf430b067875fa3c7a101dd9c244d0ed0edb7de83ff3ac5ecb388
MD5 0756cc3b09c717deaa45e0d848e9148e
SHA1 4f1a56e73e7216c52d184867d0c0734d84cc3793
SHA512 983d7b8fe2ea47310e13eb7479001f5af8ca923a2d298e25e3fd49afba138c9dd3c296554bf6ca61fa14421d02b0e49578da013246b4d78f6fe8602352ae4344
TLSH
T13B71B633A9A4AA2B4DF39950B8C52B1677614137E2D13F98D9ED0F0C01DB7D86302C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State
Size 4KB
SHA256 e0b995d8d02b5f1263d732d85bf872e23d0d675b3ee240dc6c94424ac1392912
MD5 64bf55caaf986b447e23604932ee0192
SHA1 0cd28ccef8fc1e9ef3d41b3fc15cc5d74e22daaa
SHA512 b95adeffc4ba430f6a5bba2547296ae2e023c30417f0d185436a80b8c89da31380a3676dec42ccb522a1810c733f113f66bc76da59e1aaf1439a071d3e516cc2
SSDEEP 96:zujR/3NkCufrt25u98Frh/cInURoDotoN5m7FDUBV3M6GhZySIXZ8TU68Da:zw13NbcuooDUaUYV3PSSE5
TLSH
T17D91A426A8B4AA374CF3E541B8863B13B6A15167D6D53F94DAEC0F0C01DB7C81342C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58c36a.TMP

Path C:\Users\Admin\AppData\Local\org.ezfn\EBWebView\Local State~RFe58c36a.TMP
Size 1KB
SHA256 1f1fd2ddaad86e38086be25a56cdba4d686812ed6b11df4f5b41183dc7713108
MD5 215fced4f155bd852654f504a18cc9d3
SHA1 48d9ff516cacd5205d22ed8457ed905c1004af29
SHA512 16af733771f6ddfefb17ab7a065410ff69589bbdca76dee813a27ae3bf3b9f488a2c693f9cd2f4a1c74fb4f87f96059fe72956d81d1fbea03b02766065a8d471
TLSH
T1A7214073D4E46A36698154A1B141BA5B3E60407693A09F08E6DE060C22DB9DCD62AC33
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

EZFN Launcher.lnk

Path C:\Users\Public\Desktop\EZFN Launcher.lnk
Size 1KB
SHA256 b229c925d721648583d362f7a5885af9983908c44b480452bf0a61a7a908ced5
MD5 6b38aef83b59f815e06d2f6eac97454b
SHA1 9a39bed93d86320454776bb4062d21e04814b9a3
SHA512 c22bf7be0498dfb75d6f317b656f048cfbb1297d5f99aa95527c5a894808d702a7c3758108a2d94a3c260f600cf33aca3106a62f196c101d1eaca8b678ad2069
TLSH
T16A115C210BD6269DE3B28F34483687114B67FC06A5788F2E0485E68209791009E69F7A
MD5 SHA1 SHA512 TLSH

Submit Download

e589fd5.msi

Path C:\Windows\Installer\e589fd5.msi
Size 7.4MB
SHA256 77cd56844de4bc403b8b5fd921a295f639a932960665d31618f1395ffa6bd228
MD5 706c630a1461c1e2c42eae975a28b986
SHA1 9265d799175eeb39e4d842bf523eb5f127c96968
SHA512 822662a2e1d52508fd31abf9906ee7390ac289ff8864f4bc04b33f2b3228bd0b234a771a54b0796cfe988896c4e5c5dda38125519bae07b6d6862b0a41a50fd2
SSDEEP 196608:eZvzCsZWZNoCZR5kUS4m126mXHv8VKY2XH7112v:czPZONo6/kF4moXPCKBL112v
TLSH
T13676334B3E84A661D4A70D765875EB918F3DBC244B6489C32386B309EFF02D10FB65DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductIcon

Path C:\Windows\Installer\{ED5C5759-EE42-4338-83F8-E608577764DA}\ProductIcon
Size 21KB
SHA256 e701c590c8ae73e0f31b5d9f1de78be78c757f8f1f9527c02281f56454265b37
MD5 ee03e934f65f1d6be1e3623550960da9
SHA1 a4db98769343948f34dd977cfdf56725dabaa836
SHA512 a2ffca8ae7a6b7bca608ec587ec939d1d5ebc2b962227e3268d4a373ab0005a3b542fe0c0348bfce6e1d9ada0f42252631ee4bfa35bc34e70bb181923a83dc24
SSDEEP 384:Fv2wTVGyeCwGDrgGcl5GPsNrHagyS9Wm3eKnR7FvDWrXxDAgkf:FvreCwGvcl19Hagy4nR7Ek
TLSH
T1E0A2D1DB7079B905FABAD635D9323298E6FAC22C1387C9D3948F43467D900C828B57D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 5f104cb68a09a4885ce571fb6afeed2c6d19f84fdaa150bd1b208a74db302ccf
MD5 de8c582856f43b5519c9877112296876
SHA1 c4af8d65398fcd73438f8f56034ea1da82da0ce5
SHA512 b4fc865e4aa8aec86282a73de94947e0ccb62e1a74e2cf9e7345cf50ab275f8f8add680f363d686dc6340346b7fb9691ea28bce26ec88b5b6f82ce1b3656ba68
SSDEEP 24576:Fu8m+1zmdoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:c
TLSH
T18247D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{55e1074c-da17-43dc-839e-61aa6639024a}_OnDiskSnapshotProp

Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{55e1074c-da17-43dc-839e-61aa6639024a}_OnDiskSnapshotProp
Size 6KB
SHA256 0a6822abaa09644c53c47258a5f7d057114c61c1280ef930d11c25c24a51dc83
MD5 a01406cd1983fcc5fc7227086608b1f8
SHA1 f73218a99e96448b418687a00285f161d2fdde4e
SHA512 11726d9dc205c6caa0dd3eeb5342d3b91edc9f89647b5a3e6267dcdd8ea1b199573ed1257f8a1738d031fae6b83a5348046889c1d936d2e9585095fc0e5fb077
SSDEEP 96:FYDhdCyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:itEIb++ZVmN
TLSH
T1E0D198184AF54311E2B3AB3128F18557A877B911EF33CB8E0198638E6630910F976F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/216-182-0x00007FFCF3200000-0x00007FFCF3201000-memory.dmp

Download

memory/216-703-0x000001A6E0710000-0x000001A6E083A000-memory.dmp

Download

memory/1864-72-0x00007FFCF3200000-0x00007FFCF3201000-memory.dmp

Download

memory/1864-693-0x0000022F08CD0000-0x0000022F08DFA000-memory.dmp

Download

memory/3536-1224-0x00000284904D0000-0x00000284905FA000-memory.dmp

Download

memory/3536-1261-0x00000284904D0000-0x00000284905FA000-memory.dmp

Download

memory/3732-86-0x00007FFCF2030000-0x00007FFCF2031000-memory.dmp

Download

memory/3732-85-0x00007FFCF3E70000-0x00007FFCF3E71000-memory.dmp

Download

memory/6080-1226-0x0000021EBD800000-0x0000021EBD92A000-memory.dmp

Download