hxxps://steamtools[.]net/download[.]html

Analysis

user interaction
yes
max time kernel
960s
max time network
960s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://steamtools.net/download.html
Sample260628-eyr78afs31

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
43	540	msedge.exe
215	5144	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
124	st-setup-1.8.30.exe
5896	SteamTools.exe
1700	st-setup-1.8.30.exe
2504	SteamTools.exe

Loads dropped DLL 31 IoCs

pid	Process
124	st-setup-1.8.30.exe
124	st-setup-1.8.30.exe
124	st-setup-1.8.30.exe
124	st-setup-1.8.30.exe
124	st-setup-1.8.30.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
1700	st-setup-1.8.30.exe
1700	st-setup-1.8.30.exe
1700	st-setup-1.8.30.exe
2504	SteamTools.exe
2504	SteamTools.exe
2504	SteamTools.exe
2504	SteamTools.exe
2504	SteamTools.exe
2504	SteamTools.exe
2504	SteamTools.exe
2504	SteamTools.exe
2504	SteamTools.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
852	icacls.exe
4152	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\SteamTools\Qt5Network.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Svg.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\platforms\qwindows.dll	st-setup-1.8.30.exe
File opened for modification	C:\Program Files\SteamTools\SteamTools.exe	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Core.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\msvcp140.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\imageformats\qico.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Uninstall.exe	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\SteamTools.exe	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Core.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Gui.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Widgets.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\msvcp140_1.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\vcruntime140.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\vcruntime140_1.dll	st-setup-1.8.30.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1883382823\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_686774674\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_686774674\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1703067183\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1703067183\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5144	msedge.exe
3312	msedge.exe
540	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270940904048880"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{D7D0CEF7-6A92-4CF6-8D29-6AF77996EAA0}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{2925A3E5-2546-40E4-BC4A-EF6EBAF12FD9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{02660230-F35B-4B5B-872A-4099B4E94F01}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5896	SteamTools.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5896	SteamTools.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
1320	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5976	explorer.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe
5896	SteamTools.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 4444	1320	msedge.exe	89
PID 1320 wrote to memory of 540	1320	msedge.exe	90
PID 1320 wrote to memory of 4724	1320	msedge.exe	91
PID 1320 wrote to memory of 2932	1320	msedge.exe	92
PID 1320 wrote to memory of 4724	1320	msedge.exe	91
PID 1320 wrote to memory of 4724	1320	msedge.exe	91
PID 1320 wrote to memory of 2932	1320	msedge.exe	92
PID 1320 wrote to memory of 5976	1320	msedge.exe	94
PID 1320 wrote to memory of 1128	1320	msedge.exe	95
PID 1320 wrote to memory of 5976	1320	msedge.exe	94
PID 1320 wrote to memory of 5976	1320	msedge.exe	94
PID 1320 wrote to memory of 1128	1320	msedge.exe	95
PID 1320 wrote to memory of 1128	1320	msedge.exe	95
PID 1320 wrote to memory of 5680	1320	msedge.exe	96
PID 1320 wrote to memory of 2224	1320	msedge.exe	97
PID 1320 wrote to memory of 5680	1320	msedge.exe	96
PID 1320 wrote to memory of 5680	1320	msedge.exe	96
PID 1320 wrote to memory of 2224	1320	msedge.exe	97
PID 1320 wrote to memory of 2224	1320	msedge.exe	97
PID 1320 wrote to memory of 1952	1320	msedge.exe	99
PID 1320 wrote to memory of 1952	1320	msedge.exe	99
PID 1320 wrote to memory of 2320	1320	msedge.exe	100
PID 1320 wrote to memory of 2320	1320	msedge.exe	100
PID 1320 wrote to memory of 2776	1320	msedge.exe	102
PID 1320 wrote to memory of 2548	1320	msedge.exe	105
PID 1320 wrote to memory of 2548	1320	msedge.exe	105
PID 1320 wrote to memory of 3420	1320	msedge.exe	106
PID 1320 wrote to memory of 3420	1320	msedge.exe	106
PID 1320 wrote to memory of 3420	1320	msedge.exe	106
PID 1320 wrote to memory of 2576	1320	msedge.exe	107
PID 1320 wrote to memory of 124	1320	msedge.exe	108
PID 124 wrote to memory of 852	124	st-setup-1.8.30.exe	109
PID 124 wrote to memory of 4152	124	st-setup-1.8.30.exe	111
PID 1320 wrote to memory of 5852	1320	msedge.exe	123
PID 1320 wrote to memory of 2300	1320	msedge.exe	116
PID 1320 wrote to memory of 5472	1320	msedge.exe	117
PID 124 wrote to memory of 4808	124	st-setup-1.8.30.exe	118
PID 5976 wrote to memory of 5896	5976	explorer.exe	120
PID 1320 wrote to memory of 1700	1320	msedge.exe	121
PID 1320 wrote to memory of 1288	1320	msedge.exe	122
PID 1320 wrote to memory of 1288	1320	msedge.exe	122
PID 1320 wrote to memory of 4244	1320	msedge.exe	125
PID 4244 wrote to memory of 200	4244	msedge.exe	126
PID 4244 wrote to memory of 3208	4244	msedge.exe	127
PID 4244 wrote to memory of 5144	4244	msedge.exe	128
PID 4244 wrote to memory of 3208	4244	msedge.exe	127
PID 4244 wrote to memory of 3208	4244	msedge.exe	127
PID 4244 wrote to memory of 4144	4244	msedge.exe	129
PID 4244 wrote to memory of 4144	4244	msedge.exe	129
PID 4244 wrote to memory of 5364	4244	msedge.exe	132
PID 4244 wrote to memory of 5864	4244	msedge.exe	133
PID 4244 wrote to memory of 5864	4244	msedge.exe	133
PID 4244 wrote to memory of 420	4244	msedge.exe	134
PID 4244 wrote to memory of 420	4244	msedge.exe	134
PID 4244 wrote to memory of 4920	4244	msedge.exe	135
PID 4244 wrote to memory of 4920	4244	msedge.exe	135
PID 4244 wrote to memory of 1532	4244	msedge.exe	136
PID 4244 wrote to memory of 1532	4244	msedge.exe	136
PID 4244 wrote to memory of 5800	4244	msedge.exe	137
PID 4244 wrote to memory of 5800	4244	msedge.exe	137
PID 4244 wrote to memory of 3620	4244	msedge.exe	138
PID 4244 wrote to memory of 3620	4244	msedge.exe	138
PID 4244 wrote to memory of 4928	4244	msedge.exe	139
PID 4244 wrote to memory of 4928	4244	msedge.exe	139

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamtools.net/download.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2f4,0x7ffa06e8c188,0x7ffa06e8c194,0x7ffa06e8c1a0
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,7337495292704599563,10639546728624361303,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1361013648871420238,6247950366595284806,262144 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:2
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,8345998104863300215,18085267376950455670,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,5913563809513574576,13204520863354997521,2097152 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,17930419632924293819,11600288843144028644,2097152 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,12128632878553773395,18293524312806216463,2097152 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,4585829012281427528,721347104204155288,2097152 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,10965688976548256260,12342529191616617028,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,15287887390287220127,14790846644665402265,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,8432099381669311085,14400235509726276659,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,8432099381669311085,14400235509726276659,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,5651940302803415334,17735879887103754955,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6604,i,15766269811139870,9068086985205240435,2097152 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,8069255758955067107,16857707324837472143,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
  2⤵
  PID:2576
- C:\Users\Admin\Downloads\st-setup-1.8.30.exe
  "C:\Users\Admin\Downloads\st-setup-1.8.30.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:124
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /T
    3⤵
    - Modifies file permissions
    PID:852
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Program Files\SteamTools\*.*" /grant:r "*S-1-5-32-545:(OI)(CI)F"
    3⤵
    - Modifies file permissions
    PID:4152
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Program Files\SteamTools\SteamTools.exe"
    3⤵
    PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7460,i,6098379262031047140,11827205375231566289,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:14
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7464,i,9341925441221171097,6447282897608671418,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:14
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7468,i,17485874092352489724,14592206122166634707,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:14
  2⤵
  PID:5472
- C:\Users\Admin\Downloads\st-setup-1.8.30.exe
  "C:\Users\Admin\Downloads\st-setup-1.8.30.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,15246409370317721704,17426024195701738297,524288 --field-trial-handle=2668,i,1879960713649489425,9937866685515415785,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x234,0x288,0x7ffa06e8c188,0x7ffa06e8c194,0x7ffa06e8c1a0
    3⤵
    PID:200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,663957183029177087,2571399857272548706,262144 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,9578779873702847884,9466297038248012937,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,9588562765910030018,11086783636250420216,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:13
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,14510645406102883247,6321387472031662603,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
    3⤵
    PID:3504
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,14510645406102883247,6321387472031662603,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
    3⤵
    PID:5364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,13940123645999631360,17467532246979121062,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,16538263623492122195,11413220672386260640,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
    3⤵
    PID:420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,8237764671989858599,15408853727715448924,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,4152188481389313057,13659128268987583857,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,13091299686890719999,6058673058739895044,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,4216063238008553299,4669651316495273156,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,7270066765092428958,16938330261457153794,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,2266744508965861470,117877205136699421,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,4325577418623569259,17888878278887751646,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=604 /prefetch:14
    3⤵
    PID:1532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,13906473377951205127,5042791104739990225,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5232,i,12456618451053771515,9274198938128876314,2097152 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4652,i,16654202059968231839,16182634295482051979,2097152 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,4031118818206084832,15684416327886243569,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,9537142108123117290,14726219976073423216,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,5013802051283518362,16678781911951741954,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
    3⤵
    PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6440,i,15693809108549588005,12994863193603659172,2097152 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6656,i,11960088679439572922,10272630685711648999,2097152 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6080,i,8619598769363276212,4775016747993993745,2097152 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6360,i,15675167269038266752,16805940423399860709,2097152 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,11100955968222485503,7870715863047292357,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
    3⤵
    PID:5848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,8335029113691439807,1358205672587707829,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
    3⤵
    PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5160,i,14311861574861328480,14241259572897555747,2097152 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,16946785387460863761,16911489628322755324,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
    3⤵
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=5724,i,6371027633700530183,14528351785179840589,2097152 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,4007631724012989364,7982296004971670121,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=808,i,4458116100477913450,18350828970513880930,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,13326946782425239154,4729398192819787093,524288 --field-trial-handle=2212,i,16112513991769976004,13150961189879506570,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffa06e8c188,0x7ffa06e8c194,0x7ffa06e8c1a0
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1960,i,1950766915441534300,14321276767185718624,262144 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,9305318779037363639,3780400316636103423,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:11
      4⤵
      System Time Discovery
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,7360671690319658169,14706408857531161869,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,7074896259444761709,14972427463536648459,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
      4⤵
      PID:1992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,7074896259444761709,14972427463536648459,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,10779341645246949672,7437212356181319543,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,7949453318787833350,13361302033402176023,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,14087113035272498143,16605525073264670719,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,4294083157382658638,1676400588276109312,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,17487671378122930925,3061102160432359078,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:14
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,10935442072292612317,5519314433833270441,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:14
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,1588507596138280254,4918177380439387224,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=1248 /prefetch:14
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4816,i,10424731271862771211,10795843749612794915,262144 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,7548850958568372268,1689750384618496480,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,4088059272840560042,12271905975631580957,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,6066255239230558538,18064534568736219097,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4044,i,3077338851800774119,17327287905430953490,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:14
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,4269531763303956071,1031248828043642264,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,9711163522873019459,754972219862698774,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,5652780146571673817,18030008973506967445,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,8118565980005045910,15842785450686300264,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,5831854468230833082,7503719546822459005,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,16439309188095814734,13976261508070267445,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,7224654140891333434,2811406384955640651,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,11118818870395025947,4119647801948264486,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,14409258052362230723,3653117964801126955,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,18367341085797204465,13791001562693504181,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,17431512278622540106,8403691695446205322,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:4012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,3939773372325275579,15502575015660331598,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,14167092808858874057,563551793511433046,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,179623774056412572,24554943637922357,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,591446235426762131,15076492745928848972,524288 --field-trial-handle=2428,i,14587645871206397146,10439269487167580138,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2660

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Program Files\SteamTools\SteamTools.exe
  "C:\Program Files\SteamTools\SteamTools.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5896

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5852

C:\Program Files\SteamTools\SteamTools.exe
"C:\Program Files\SteamTools\SteamTools.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2424

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:4100

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1108

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Core.dll

Path C:\Program Files\SteamTools\Core.dll
Size 657KB
SHA256 0efd139f4201aea356b6baddb159534badfeb388bb7dd54ee9d614f166cc64a2
MD5 a0f3f5d8aedd622aaebc9251e10c15ed
SHA1 271d2c2362f979d47b79acee65cc4ef7b152343e
SHA512 5788813567c26c8a70f6a4369085790a49c44c02a706d7b5bcec68b98ba773598840bd57068aef34fa4c0a25ee5305ce7293335921e33fd25f92c664eb4dd72f
SSDEEP 12288:JuigyYF+iXvJAarykqB4YbiKxXiVncYNCdJqgmVKcfK12:Ju7LciXBAaTe4JKxXiBREdJNma0
TLSH
T17DE48E56B3F400B9D5A7C138CA534517E7B3B4551320ABDB07A09ABA2F23BE1673E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files\SteamTools\Qt5Core.dll
Size 5.7MB
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
TLSH
T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files\SteamTools\Qt5Gui.dll
Size 6.7MB
SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
MD5 47307a1e2e9987ab422f09771d590ff1
SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
TLSH
T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files\SteamTools\Qt5Network.dll
Size 1.3MB
SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
MD5 3569693d5bae82854de1d88f86c33184
SHA1 1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
SHA512 e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
SSDEEP 24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
TLSH
T168556C67B3A142E1D56AC139CA5BCA03E672700087665BEF1279CF592F737E2263E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Program Files\SteamTools\Qt5Svg.dll
Size 322KB
SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
MD5 03761f923e52a7269a6e3a7452f6be93
SHA1 2ce53c424336bcc8047e10fa79ce9bce14059c50
SHA512 de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
SSDEEP 6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
TLSH
T1B0642957F3120896D927D27CCA9B8916E6B334100363DBDF022A8A5A7F237E17A7D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files\SteamTools\Qt5Widgets.dll
Size 5.2MB
SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
MD5 4cd1f8fdcd617932db131c3688845ea8
SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
TLSH
T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamTools.exe

Path C:\Program Files\SteamTools\SteamTools.exe
Size 1.7MB
SHA256 992d547bbf83f26f3117b27aaa2a2e2e665f76658b67c27e84b13dc379833eaa
MD5 9ab2a4fa1b4da8db2e102c0fcba6e5f0
SHA1 a1b85c90f9f3717570448bab83d9ba103cb31a13
SHA512 acd2445a4351e9a1e04caa574631ae8480386d411adbd7b74af24085c85fcdc487f0f90432e496b3fe47258d6bf21a74c1f9f001b006ad4912c4e432129eadbb
SSDEEP 24576:X5vF+/wYyf1jXjBHT0SMSnVpcZuphOH7q9r/bWYAo3P:5F+/wYU1jtIKKZupaqhz0E
TLSH
T1BF857D0BB278C1FDD067C179C51A9A0BDA717446172196DF22908AA53F33BE21E7F368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Program Files\SteamTools\imageformats\qico.dll
Size 37KB
SHA256 1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b
MD5 a9abd4329ca364d4f430eddcb471be59
SHA1 c00a629419509929507a05aebb706562c837e337
SHA512 004ea8ae07c1a18b0b461a069409e4061d90401c8555dd23dbf164a08e96732f7126305134bfaf8b65b0406315f218e05b5f0f00bedb840fb993d648ce996756
SSDEEP 768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
TLSH
T1BA038D67E72904C6E227CB39D1524A27FA31F5219B92CBCF526686590F237C23D7C398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\SteamTools\msvcp140.dll
Size 612KB
SHA256 86881a7054532019291c162f0a8177980c1c2b45490f7e88543f22915d08d9ff
MD5 ba72c2f6f465926980adc2fb7f8b3490
SHA1 63de0e3c14d0f45c1edab1c3ecd4adfb78ee8cdd
SHA512 05136a8dde4359efd112341b12e0545accc8d018e4fa7495b071197833a0227bd50879d7753b61582505b8e2286f845604008bd2020e689e148037a9ef7d7474
SSDEEP 12288:lOpw3ob/5jh6lN0RXhsdufjqDZZX/t5xTOKGmm75s79s8gywMQEKZm+jWodEEVo+:r3ob/5jh6lN0RXhsdufjqDZZX/t5xTOh
TLSH
T173D41A27AB5905B4E052E378A1C78711D7F1BC058322E3C782A6E27D2F673D5AB3B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files\SteamTools\msvcp140_1.dll
Size 30KB
SHA256 af589d441cd97638b1a0b9192a4014c52b64b35ecf5437caa65f27b3583e07aa
MD5 18a6c1a3d630dfcbc227082d5b06681a
SHA1 6634a25660e5843cf7fba6dc09b9dfcb698432a5
SHA512 5716e41de4f2ed7fee286c898411d99e11392f60df91b2423539c51016a7b9a12945087e6d1a47256c084ceb06556334ef03e34a8647d704582abe5745292581
SSDEEP 384:NlKX7EGOdlBJkQhnlVI/GD2Wcg53Wco+F0GftpBjLHc4HRN7hlI5e368:nKoBJkQhlVl3v+ixBIe68
TLSH
T132D25B86FB6C8983E8535C7092A5CE83BC3DF3C25B21965B1265E29D1CE37D0AB34619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files\SteamTools\platforms\qwindows.dll
Size 1.4MB
SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
MD5 4931fcd0e86c4d4f83128dc74e01eaad
SHA1 ac1d0242d36896d4dda53b95812f11692e87d8df
SHA512 0396bccda43856950afe4e7b16e0f95d4d48b87473dc90cf029e6ddfd0777e1192c307cfe424eae6fb61c1b479f0ba1ef1e4269a69c843311a37252cf817d84d
SSDEEP 24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
TLSH
T1D4658C57A3B54299C26BC23DC64B8B17D6B1701503219BCF01A98E597F23BE3277EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\SteamTools\vcruntime140.dll
Size 83KB
SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
MD5 0c583614eb8ffb4c8c2d9e9880220f1d
SHA1 0b7fca03a971a0d3b0776698b51f62bca5043e4d
SHA512 79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64
SSDEEP 1536:ikqwmvKrSgB91BDJ25Tg/G0G5r4Gt7qNBPS9DH6ecboHjPxu+dBsi6:i3CuavtckJSVqNBPSUecboHjPx/O
TLSH
T15A838C4567E802B6E06B9130C0E28E47FB76B485877047DF037A56AE1F53BE18B3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\SteamTools\vcruntime140_1.dll
Size 43KB
SHA256 3b792da47040c3b3e0804cdc5153eef4e802b6975963029d8dc360cb824a7b62
MD5 3b22b2ec303b0721827dd768c87df6ed
SHA1 86f8af095cf7368ccbff2d0fd6d33586145acd2b
SHA512 79db774980ee132797f7e7dbc0e055b724d8fbf0e4917523b285f918730adfff81022cc6f5e15469b011d55501fd7b085bc070e9ecdfb75c05f4d6622a7f2475
SSDEEP 384:GRiuauREnUUWU55vZvS05fJjPg2h1RWmbzA+XfAXxy85xH0f9lWrGKWVQRpBj0HP:DJnUUV7xPg4RdPvv2DHkR+W+1CP
TLSH
T1F6135B54977C8486E56B85B0C4A2CF27FE39F6925710928F0B65D29C2E537C0E73D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e151fe259fa3166be22696f9c418123bb55ad288a46450684e09f7d83fb8436
MD5 eb7999e4087e764761eef4628a0482ba
SHA1 1ed5596c62ee62c973a396ddbe1db92996bd79bc
SHA512 02333ff884257bcd8d07a3faf78a47714ec3d6c1b58f233989d8d7e36be949804ebd2c49c4391adcf02e230d7f737fccaab85038de551cb15ea89fcc30e0ac51
TLSH
T1D8D023753E3979D1D12430B5A4204311B73758A33756D2477154480D9C344D197C6BE6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 31fc2c63800da00a2d90f945b6fcacb391e7072e7062465a85494e2e262898f0
MD5 ca5692443da86d2da34060459d41862e
SHA1 f1df1b6c2f94cbb2ba9f0aa58913855f34cb613a
SHA512 4ce68679c7e11312518f326a1cb3debe9a3a5f08669766541113672b5fe3688ec32ba42596c6549a77f928b3f1fa10d331176fe8edb0b44c67b223aa45cfc230
TLSH
T1BFD023F43A593901C10120F17415836177735463B74AD5476158511D6C749E543C71F6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 edbee5990765893d2cc8e4c351470c83bed39e1a2fddb63b77036eb2b34a7a11
MD5 86e328fcf64ef686753d3abae9dd7ef2
SHA1 14dc4eec43ac53c4ffc9cacee8802c5add352fd3
SHA512 747d33512c765d163d814df4cc6ad6d1dc352e444d679b22a2a4f5554fc0798653b789f9c4f276cc42ddf02f829d9c3e76845ac25910979287282212e88fac66
TLSH
T136D023F43A593901C11120F17415837177635463774AD5476158411D6C749E543C61F6
MD5 SHA1 SHA512 TLSH

Submit Download

65fd7ea4-ce2d-495b-9571-d34706370e87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\65fd7ea4-ce2d-495b-9571-d34706370e87.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81b47a5f-d8b9-415d-b2ce-02d19cdc6d19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81b47a5f-d8b9-415d-b2ce-02d19cdc6d19.tmp
Size 414B
SHA256 02c573a58caa63620009783152d52acf76aa1f85d54795fa8c585e602f409dcd
MD5 4d62ffa53cf3451abfcbd1d0268ac630
SHA1 ad76bb99a5b1318c0f98a6d9c2d753c70a7c812d
SHA512 c5f7fa58c51f5c4d58922efd7cad37f2c953efb4c69955d42a0e0d9b5bc6caa2981ea5adfce1e93c7d5106e0b66bd2f217225e475babcaea984f7b44dd457fdb
TLSH
T1B1E02B6AC8309C7708FD4B295415030AE750435B3B81898F3B3D810C8FB273F45D586C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 8358df1ffaa89b9c4ed0935ae25508eaf7080b833b7b099ca02447804da1812d
MD5 b4b72f598e08dc1c46409f155fd890de
SHA1 676c28d110e9260e425cd517df49f6b25b2aa388
SHA512 acac497f315383fcc38166f740b1614eca4f47052ff0ab6a720e789fad8c125824706651193898a975691980a2e8e80f481291a6740618b15095659417a84f0c
SSDEEP 192:oxtfliQjr0xdM2XXVzmUvxG+YOQlnANxG4wMBYFoacBhEiWq0y5z0V0wHXzieToC:oxtfQQX0xdM2XXxmUvxGRhlno04wMBm1
TLSH
T196E17696A4F91011EF19EE706FE14FA833F0C806104BCF57542690B7D9A7B8BE2BB045
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a7a1def0e4a33ffd5c8aa746a2100e6be85bb0dc0e80289ee4cfb2ba70639596
MD5 5393e8558aa56dac1cf135daa85adafe
SHA1 29bef3359e6d653f3c16531eb6d9aa80706d2ec1
SHA512 43775b5766e1755336176ae5d9a5fbfa4307c2de6210545dd4604c4ba51fdb04d2e5938827a933faa63d1adc917d98445b1cf2c73bbae3512a4e7a60c1542080
TLSH
T1D2714FE880650961FB2AE3B576F014B973F8C8515197EE1348A4907BEED5F07738E48D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5910a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5910a0.TMP
Size 3KB
SHA256 8b50fbe662d926c485a48e43143b199860c58d67da1aa7bc77e48d959773eb8d
MD5 f8af6cfb261225275a864870f5b66812
SHA1 5548a9de51810395975e387a15005706530a583e
SHA512 c2f7f7b690eddae2466f22edf13ba13852cd619a8156ddefa2657354aea8a80efff187f581d89cbf26293b09685bd87f9e3a1cf6f2bf34c3f5cd22b1eb5dfe7f
TLSH
T151713CE880690961FB2AE7B5A2F014B973F8C85151D7EE1348A4907BEED5F07738E48D
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 65afa678ba5efe6a24a9a55eec5d5b2c06c58a1ce794b0fa80fc9feebdbdbf29
MD5 2d5cd33753f6936b00bf4c9de85a9064
SHA1 c53ccda0bd2df680780a992b6a84faec9541daac
SHA512 a6822848ffe8f52eec248f0d70f8ee9cd3df3a81384283ece8b314c6097d481b34ead464292a77c24b40f472e241fa6dc2942b42f633b0a3933d81384d5f6ceb
SSDEEP 3:MsEllllkEthXllkl2zE/l5S+t:/M/xT02zIS+t
TLSH
T1FE4404047FC00C07C710113044D1D3D01370D5150733574334554473DCC57410C14100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 52c5b3ecc51e580bb67d3df70c2030c184bcea8c3c109e850e7bf8a5374ed4fd
MD5 30b815e2ce2cb4a82db55f24113e0193
SHA1 eda23bd79aac66a43deba7fac4c78eb7ba6fe357
SHA512 67ca7b6cf374f9c7be3a009da5b1faf9fe17d7e00f7e2a6f11dcba097117b87227e758667f89f2c6d53b0791b379c189c08a37df1ab5b95e93c7c054314eec14
TLSH
T1F4518CF7C2E4856DDA1185F0AB146E1BCE1D0915532C3C5AC9E4EF5B93E3471E201A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 5b98c36d450e24d9c79a768e912c2f0938159982c112ed1c883a99cbcb346e7f
MD5 f6aaa63ea9db01432e9a0f7ab7ba3c03
SHA1 3d43889ba38760992671c7fd9a4599371bf1edab
SHA512 c9d2bd5aca0c2936c13772e13edf14227263f7017ca996ff26e0cea277a1375085345b33b87fa083ff3789a1a7d5826654a28497ab0ebd24e535643ef3a71da6
SSDEEP 192:DsE/OihB+WRNP1E/VIj69E/Vaav40iI75f/ccGCfttA/gjv/Igozx:DsE2ihB+WRNP1EdIG9EdaavtiI75nccW
TLSH
T19ED1EBF783E5826ED91191F0AA146E1FCE1D0556436C3C5A85E8AF0B93F3471E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 86fb81d1a6c7da05a9c4fd78fe407c07dfec111c734c430a62905fe51698e2e4
MD5 1b75bc288c171e8471a84e65553ba021
SHA1 b4452d897b3bd1d872886506eba9427fb14b14e6
SHA512 21ee95616c3d66f2c40617d9312b75ddab9dffc3eac1a183a85d9e1238597970644f6f0dcba530b043df5e358d8d347d809b3f5e4c2ce1f302120120c58ae805
TLSH
T1DB518BF7C2E4866DDA1185F0AB146E2BCE1D0915932C3C5AC9E4EF5B93E34B1E201A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 c1e8f9fa06bd6767e536cf1d22ae31a03e331d217ab539fd9ca004f12ed3304b
MD5 7c552b8e9c5627a15aa69982112cda14
SHA1 e7b6be6c6231f58d6f60b2945f1866b32c71e0f0
SHA512 210eaba2354a5db7d223c5a8d782f2b32f0e52ddca43ca1c3c0b7cdcce3a28e6506707bab626ac69de4bdf570d9fb38052c7dad62ef6060f1bed5eb72004ce29
TLSH
T148D02313324170B7D65C7E915156BC4FC72F21110D17DDD720D0589D153647E050B545
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 6ce93d87f1495ae7205e657a565cb7e98b54031d5bfe3dc8403b97368dc5a557
MD5 510e3c6ef2c829a65af47d07a884fb8f
SHA1 fc7d759b0e75f8eb55253413cc9b9f0f4245f7f2
SHA512 a6bfe05859898edc66f3477e41e700a4b89cb05f84e9d5d9fe02da7aedce23481b57d3610f364cac18588fec382a040805fb2127b1d2cd3a7a8021a219ac7fa4
TLSH
T1AF316EA7967FF85F2028187B1E487C095F79F431529368F2DAA6C27DB0825F70B16062
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 33dc6c7470567c0be4e04ea4033c54ba36e2b80cb450621760e8d5096eb4c5c9
MD5 a4a3b0eea466aaec8534477988aefb4b
SHA1 e37e7a09343a01d1afa9a7d44b64c10fa93f2147
SHA512 5ef8ac311d849832eb0138aa6cb16698394ebb4e611c26fc85c033bf0b6f0d1d9115269547a914ff228986312fc443163a0f3bfe323c470a61183aec8d135df4
SSDEEP 192:sxRoRGyM/jK1Ml8wFc/fMsq1xwNkUYhzoA8pSt/g6+WN7QBP/YZOEG1IgIJ:sxRoAbc/fMsq167N+/57S/ps
TLSH
T1DD52E9166A289977CCDBD209FA517F53D6F81573A2941E44AAFCCA0C01E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fab63e8afe4a6df3d29c29a2eb51d89bc77fdff5ce8097626d18a404eef4d0e5
MD5 018daba96b04b4adc5152cfb430fe53f
SHA1 bfcdf153e22b8f8ee4a6c29a01fc6bffac061a4d
SHA512 abe17ae116357429361d7437774dbaf59ec0759a6236faeaf86396b8c902c8809202ddb65d13b44342024980b0376856f41529f8cb173d4345bd25ede43595ed
SSDEEP 192:sxRjRGyM/jK1Ml8loc/fMsAWpVpaxwNkUAhzoA8p4t/g6+WN5RWQBP/Y9rPg1Igd:sxRjAhc/fMsAWvpa67lQ/55QS/vd
TLSH
T1E362C706A524997BDCDBD20DFA557F63D6F81523A2901E44AAFC8A0C01E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 6852b30e473eeb2411d3180f117939742595d0f8cbf85fe99cca76a0bec5c723
MD5 ecb0f657eed7b3f6a185727f0044db5f
SHA1 026eb34e6abebd9c0ecfe391462481fac81d2c41
SHA512 77ceda6701327eef4f36ff5b6d24eb6d061dbf49bb39536e4216026a167805f760c24fce4b504b1d1f379ee3d3899e3bb3233b52f0b98f40bf262cba2622d0cb
SSDEEP 384:sxRa90muc/fMsGWvpd/6K85X0A/5JO86S63e/KpT4:seymuc/fGYpd/65/5JOLh084
TLSH
T16C92D756652489BBCCDBC219F955BF63D6F81463D6905E48AAFCCA0C01EB7ED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bb9153cef71e4e60e74b609ed61511a7127dab1a32802c316e1836fb462d333e
MD5 f61f65305e6b8ae907051497db7ff753
SHA1 48f582e57a350d9987a6d4024fced1ce05ebc65a
SHA512 545457738d0ffbb2e56b06a9a1ee23124d1a5342ac81cbd4baa5dbcc5237457cdb927adbc1bc41a276c9490d9f5ee818f7dd5938bcf29e601eb145aca0e81dc0
SSDEEP 192:sxRjRGyM/jK1Ml8woc/fMsD1xwNkUYhzoA8pSt/g6+WN7QBP/YZ3EG1IgDhJ:sxRjAOc/fMsD167N+/57S/4v
TLSH
T15E62D816A9249977CCDBD20DFA517F63D6F81573A2901E44AAFC8A0C05E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 95b5a1b5793659e530637a660b1cbebed8fdb69e5c3ce15b8f5f00ac527c9ac8
MD5 bf3e25d83b4681f700fa68aef5b95e61
SHA1 707de93f93bc4ddb00583a8b3f68f67da6ae49b2
SHA512 5485d9aa22a151ee8f069a349e6b136522f1bfe30f9e1a8ca423d079cec242eab8fc47b69746d18cdc8cbaceac2d731c4cc0a68c8dfed9511650b1e94fb4c6fc
SSDEEP 384:sxRj9hPc/fMsGWvpd/6K85Lxy/5576S/7W:sXfc/fGYpd/64/55moq
TLSH
T1E282E806A934597BDCD7D20CFA56BB63D6F81563A2905E44A6FCCA0C01E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 7510398ed5e6ed9e899b3aa28f9ff88d17705c316a7b95604096e2cf4626e2a3
MD5 515f143a31f78f29cdfc9371f22d2b40
SHA1 a7b50f484143d8e63c6e909865b81266271b5452
SHA512 075dcf85d7888c097885a54c3386a8f4757df72b3bd9b5b92f02ffbe3a5b6acc144f2e4c6b3429c74431a3b99a5b451ea401e61cd9c0e9b5b2b0ad47f31b0703
SSDEEP 384:sxRa9Qm4c/fMsGWvpd/6K85v0H/5J76SA/0pT4:seSm4c/fGYpd/68/5Jmru4
TLSH
T1F792E8166524997B8CDBD209FD667F63D7F81463A6514E48AAFCCA0C01EB7ED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 20030d74a73677754c5a330b4d3143f9d5ef3ce87d1e1436921035af3516c850
MD5 739fa9ac7156d1f2c6c2abe989c413dd
SHA1 7a26e020c0b6878209a343adb163578394525cdd
SHA512 4a4b3bd662a92ae5fdca993336f0cf5467710de25f3aa6d179fbcf09f89c049330c8dbaa2667013ce243213f924776152537dd90d5a14e5325a3ce0758b16049
SSDEEP 768:eOEt7IWgKgf/68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EkTqQUro7ov8n+D:eOEt7IWgKgf/6u1jaZ/Q/88+D
TLSH
T1BFC20B2B240CC77E4F840E5DAD2ABE976DD801CB9B988D4447EA890C03C77EF521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\837e7d7c-13fb-4433-b877-6f203b6253e0\index-dir\the-real-index
Size 72B
SHA256 60737f3a356bdcb03c52efb12b523c7fa97e38310c618864110526b975c99c2e
MD5 02b14158b24f5a16d01cb85c84ad66b8
SHA1 c92fc6ed1cf5d31120d97ddd97eff3633eb8263b
SHA512 7e94faa7dff98efe9618c226df1dec9463314c91d9eac1f8e26aa25f49a4c93830c786d50571354f8407f2a7305ef84c805363689978ef3c22b828c2232fc2a5
TLSH
T1E6A0025833A03095C41691B1176212421301DC242206260EC39122C4CC90881854170C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\837e7d7c-13fb-4433-b877-6f203b6253e0\index-dir\the-real-index
Size 72B
SHA256 5120097867d39424e7bb8653996a6c7ad420aa3e9bc1bb6bac0e688d84d388b9
MD5 0e573c44d1a536d9d3b1f640d3dce502
SHA1 a2eb6de9c42a1d441e7e80ca10e1ec633fb48b48
SHA512 7aefe0510e2a3d292da15a9c4cf2e11efc501324a73b4b4462cc5fc755a9a6d7f072d29637bde758cf724f502dc6e5f5cab8c122f743a952104a3eb325b118f9
TLSH
T1FDA00214068A3082C00622B376EA11B6235359904201573649E4004DE9D17C64A4604D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f9fd82d-b210-4109-b489-f797ed71bcad\index-dir\the-real-index
Size 3KB
SHA256 a205262d22706754d0a684c00622a32f9d5522d295b70bb0cb97ab19799c789a
MD5 dc7a880e837484b89de7944c3f1cfd74
SHA1 f3cf1608c378e8b9e99b0fcd3ec885c2009c6573
SHA512 2a3e51653fb50033d195d635fe9424cf9ae3ce240ba38db901036969e740951bfb26b7b00b8072ce0f1c3cdd72c064abcdcafdb41b881dc7b2a27f92a44c0693
TLSH
T13A51C75D8CC71B1BED68567324B21488237938DC1B888F137DBC513CB8C7629186472C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f9fd82d-b210-4109-b489-f797ed71bcad\index-dir\the-real-index
Size 864B
SHA256 a8b2479832d19493625bd75415240dbe153bdd057be9eccfdd74e999f193ca87
MD5 02ac1a37f361a11a7104f2d45add5e47
SHA1 a042201d0bf1cfa5bc87fc09b9ed5e12f04fcaa9
SHA512 f677d8605a60db5731630f7da81e2a6568805e059476547077804a577e55978af4476bb8585e35df55fa0bc0cf037a4de2a1f50b07b015e4d71e93338da181a2
TLSH
T13211DDAA6CE0381ACE11213B2A75749E3733C5EC2A5CDF13213C753C5892726295029C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a76e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f9fd82d-b210-4109-b489-f797ed71bcad\index-dir\the-real-index~RFe5a76e7.TMP
Size 864B
SHA256 d7f30b8a0643982904cbe23a79300788382d4c6a35ae130670f01ec80079450e
MD5 256fb4b64b1551291e14fdc80f05d402
SHA1 fe84ff2c26940efb8a8f61e9c8409c5b7913cf52
SHA512 f98dd5ac073ec023db0b37c880421e9fd2dfe6ec4798344e821b6d19ca4f25825c667c68a940f2d08054bfb3a1460c84aa0be0f677579b8f5650501e8da9d956
TLSH
T1431141E724A1BD96CD022175AA63401E3337D4942118CF1730B4B43C0C93B163EA40CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ce35a6fa52be28121078241115409f9c2d659b38868d0a1131bab825ed4390a6
MD5 47779dfec71b4b1de7248c91e70617f9
SHA1 64d54f7bcd60b3ca9c769b6fec4a5d30afcb3e4a
SHA512 fb1ac5baac973ab6de8a8e2c6a08fb7d5e2a6b8f421f91fbd5bf320793b1a1353b24cf72904c777b1c9a187aa9a61f8771a7bca983ec4652bce90a0c828821d5
TLSH
T194E020F77EE71C04AC7BA3D95471E4500012BD58C715EC8F602FE5D764B13552856C66
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c2a0fd7617db5638460f2716afa3b0fd9b259df91227db445858554aa5ff812e
MD5 f42ca540da9e6f73525b067af6fada0b
SHA1 41c6132b3c38e6f640db625516cef4f21a93b92d
SHA512 ef8e707bf511885ded9880663792781149cb0ac74d224960f2f211cd2077e8e597eac71298506f2953f67f2a29d68c269867cb1cb8056f8bd0e03ac8e8ea50ff
TLSH
T1C5A00292966B0C45E4000270B45111842310C910170A225742E41466B853256C113464
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aca95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5aca95.TMP
Size 48B
SHA256 dcc62754fb22e3fd16d0d3935ed6f9ad7de403986184d40b792a7f7411e652b0
MD5 f83cdee0ec9f6f073249e05e600e96a3
SHA1 7305b08fad9e4ddaa16c4602df0cbed331905584
SHA512 4dac0caa427d56709b8e1bd8dde1f2d173174da95129dedbbe2296441fe5e7a9b82e783920890ae01326be3ea805fd6e41d010209ca5fa29aefddcd358526a7e
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bb8c429c9bb2e34a0a9216a8cbdf8b6fc3412bbeec4db4f1a38b8696c14dc08e
MD5 1e109c6746c1e9a6afbf1224387188c3
SHA1 6348a0a36583a76e83b1e6330ede57a13316d0a1
SHA512 ec0a53667dc0577a8017b2b588d5aea7080e59f20cfeaa7a7a1af1728df786401334598a2c5f62066d8a72c784a430a0eacbb88f9993962fc37b74cd056efc10
SSDEEP 48:K0QIDK9S8TyV/IVKUEInYdE46yC2wyv9Ih42KqTCW2Ggmf3mYnygv0lBfRdnz:K0QgK9Sy2/WKUEDbKKwYy6z
TLSH
T1E2914400357B230429BE3A88D790996F42427067745BEC2B7BA920D25E6FE015EFEDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a8a6ddd3-1893-4e23-9b3b-e9563a4c6b57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a8a6ddd3-1893-4e23-9b3b-e9563a4c6b57.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 6f47eb4cc31d970d8f0634c020c47597c044caf50dc53985503f7864c77bf8cd
MD5 7ca2c63ecb684fc2542d41c5525f91e0
SHA1 3bd14e61d5966bbec1498817afb1d02bb3522fec
SHA512 742e4f441fca24b4da92003bd4623513fa47774e11c20b455dc83e680721741e2051b6acadaf331f30bccc46b8d9e987a632f689b475ea98a406a228a0f5f433
SSDEEP 768:MFKj+9J3bwgOb8+hAKfcOefZhfu9V5R4HTytYYqgHvP7xzn12bfZ4:89J3Ab8WfifLfQWTwJlByZ4
TLSH
T1091328F698D78976D8AE8783633D2E46AABCC163B2885990F7D44D0CCD871BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 51KB
SHA256 2c85be348da6333e9bbfb2217a5ad7d42524d82a6b1e9ba6e5854adddc583e64
MD5 d648b03dc86396442daf761b2bfade16
SHA1 578b5e1335883ef50dc59e50b54ed361dd96a7ad
SHA512 651fc5b639adfe4d8681e812868cd922340d1691241a012aa46c42d8859c7f7008d49dc3913e3c6614befc74974cde61185793897c798d6c1c0b9b3359eced37
SSDEEP 768:MFZj+97+wgOb89hjKfcOefZhfu9V5R4HTytYYqgHvP7OSjKx1wjnzn12bfZ4:r97/b8ififLfQWTwJKKKEjnByZ4
TLSH
T11933D3F98CE7497AD8ADAB87632D2D1658BCC237F1A45494F7840B0DCDA25BFE302805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5db6236363aeff2268399410431fb412fe0bcac12b2095fbbee18519de159428
MD5 250ed4ab83ad7d850f1961cb2a48afd6
SHA1 88f34a0475c184464d1623536625842ab3fc46f9
SHA512 3c85c122cc0ab73cd73d572a50420885f671055f66958cdff507c904d5ccb63a6ebde1e4ea92edcd02c3ad704db1166b8fe47dd526c4d1421506f7b2bbe6507d
SSDEEP 768:Pj+9X3Zb8LmPfcOefZhfuLV5R4HTytYYqgHvPwA2zn12bfZO:i9X3Zb86fifLf4WTwJ8ByZO
TLSH
T1EEF2AF72ECA84DA71DE2C6857206369BBEE88627D3C41764D5DC4F0D06DB7DE130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 89462c575db27e99e6b9c1ace77bf9546e1e48f24cecd7ec5d0929d9ff798d77
MD5 981469dd8e627a477f9d163093a30374
SHA1 6e37ccabe8e16b3bcba2ccf06a268691b1bb7b55
SHA512 4794a322093dd571606da8f73c30dac4e94c9d2fcc3229c69d67396e738151f7b3ff6d4e28d6cd3f102c0cbf6150109639d1c03e042e1b7743542b1734733130
SSDEEP 768:+FKj+9J3bwgOb8NmPfcOefZhfuiwV5R4HTytYYqgHvP7xzn12bfZ4:G9J3Ab8UfifLfJeWTwJlByZ4
TLSH
T102135AF298D74976D8AE8787B33E2E46AEBCC163B1841660B7D4490CCD872BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7c8d85702b78c3707ebfc3b1b5cf39c90221eeb25ccd8300244de4139c53467e
MD5 d3789e5c49e8754e7a883874aaa5440a
SHA1 243c9717c490b6a95d739f6560f74edfaec4e0d1
SHA512 4b7d87f65c95f142e96db97ffdc52c09ecf7044cb00003f774433abe71213e190a75825fe7cfc8628e89932b056d76d09ca810588dba9444b6ac9c23fa532c43
SSDEEP 768:lj+9X3wb8YmPfcOefZhfulV5R4HTytYYqgHvPwA2zn12bfZO:Q9X3wb89fifLf6WTwJ8ByZO
TLSH
T16CF2BF72ECA84DA71DE2C68472063787BEE88623D3C41A60D9DC4E0D06DB6DE130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4436a6aa6f12c574d694ce378bb37315e8a51c1acdaa721cf5c03ff552abca4c
MD5 ab0008d41fbce91eda49ac7ddde4dc8e
SHA1 f959451183bee261b514de8b4646de48347dcaed
SHA512 c47e73084e904ebbd8d756bc0224574555822f00584ff09a3cd47dab8d74c9dd21a2cca8327de68282e9c09052233035bffca06d9e06c5d11083d918a71ad8f2
SSDEEP 768:vFrj+9J3bwg2b8DmPfcOefZhfuirV5R4HTytYYqgHvP7xzn12bfZ4:I9J30b8ififLfJfWTwJlByZ4
TLSH
T1BC135BF298D74976D99E8787733E2E46AEBCC163B5801660B7D8490CDD872BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 db1b8653d9de5392f393f9aced7380aa455142eb09b2ab2a5030fd275faf4be3
MD5 7cf7923c5be5334c8df2e351e7ee1cbe
SHA1 e2d7299f2e302ff3ab4b89ef7070ff6047a3ef4f
SHA512 39222aafc4e0b54084dd6c096518269c6cf2b830ac229cb0934dfc08ff276c25b6c41d21f00109f6529b6490bd081f474c10692ea058ec179826e70885a2f22e
SSDEEP 768:hj+9z3Mb80mPfcOefZhfulV5R4HTytYYqgHvPwA2zn12bfZO:89z3Mb8JfifLf6WTwJ8ByZO
TLSH
T18EF2BF72ECB84DA71DE2C68576063787BEE88627D3C41764D9DC4E0D0ADB6DE130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 3af3451a91b97be59beff80504ffbf58f32114290e96e4cb248b358011929b87
MD5 397cea7cc2bf580e4c3bc73aa2c86954
SHA1 d6b116dc2013af3284fd9e113b957e2749369161
SHA512 8b23bcc870d0e1b2b06b1024082e8b4a294988ecd8b6cd7f1485eccb4d1c853ab1f887f13553c3c641df484a70677ca5a47b88076e58e87c2fef6eb2f1dabc02
SSDEEP 768:bFLj+9J3Qwg2b8EmPfcOefZhfuJV5R4HTytYYqgHvPwA2zn12bfZO:89J33b8ZfifLfQWTwJ8ByZO
TLSH
T181135BF298D74976DDAD8B87633D2E46AEBCC263B2841660B7C8490CCD971BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 d39acbb91a84ab45337a3dc64a05d671bd4e7ad1b2375d3513ae42e4bf3d67bc
MD5 6df3aab37c0c1a980ae03589c31b8131
SHA1 25000187e521510f2df29844a5305abf8f2de48f
SHA512 cce4a8fdd21e607310de1d7a189c59cf03cc7cab1914381d0e864d6040dc7ad9ee6457486b60e315b2ad21ec6d4f89d8757990d8192de9d64820628b2d93b2da
SSDEEP 768:bFrj+9J3Qwg2b8emPfcOefZhfuiyV5R4HTytYYqgHvPwUuXa1zn12bfZO:c9J33b8bfifLfJUWTwJnoa1ByZO
TLSH
T18723F4FA9CD7487AC89DAB47233D2E1659BCC237F2A45164F3880A0CDD665BFE306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6c8ba4bcb248e7c8d820ac265fae6ec6ad5aaf3ef0a7a2c738eed9da37be51fd
MD5 b132973854d1c834d557ec8ede4d4060
SHA1 92f00221b04c53d5eff0de887005b16fc54c9ee1
SHA512 4a0653097342e3db89cfa9be7433058b32085e8963a9746c2049b79ea253a0101f93e5a3df2340463065a535c5bf92c78f58e1ae1567aab8c929ed4e14aa165d
SSDEEP 768:Ij+9e3Zb8qmPfcOefZhfunV5R4HTytYYqgHvPwA2zn12bfZO:X9e3Zb8XfifLfgWTwJ8ByZO
TLSH
T1E3F2AF72ECA84DA71DE2C68572063697BEE88627D3C41A64D5DC4F0D0ADB7DE130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ff10735a3ea251341c9cdfa472a3b6b539c8330ea0bf9ccf2db5cc33cc464886
MD5 a6526cbb9dc7f7b26c566bf2670dc7e0
SHA1 e3ff4de40f03894cbdb96f388ace9089e7b9e7f3
SHA512 dc4857736afd342ce5cce29f816542eeb88650ea406b35a21837fc11403d7231321708fb051f6a34baa800ba4ebe10a7e54aab100a0ab57298ba43de6bed19d5
SSDEEP 768:EjaeqD4MlshiLdMma3KuPfcOefZmV5R4HTytYYqgHvPggyjWtxjTo:EqcjhIdMh3DfifOWTwJxyj2y
TLSH
T10503CF76ECB848B78CB2D685770277A76EB842A3C3C52B64D9DC5A0D019B6CF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f29f044431ac90d59b7aa417203d0b844096eab2de38085bd288e9afdf8c3147
MD5 076f6ba65b18dc3352b78b32b79212eb
SHA1 9e54ace2a94da96d76adc898174d6b8fdf38596d
SHA512 e06578eeb7634025301585f6fb53dd9e2137eddd9f967cb84f4fa2d37357552a6013d81e0ab7f2ece6f75e8af7522220d8395d0a0d8202904237df3c233c1751
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5ac5a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5ac5a3.TMP
Size 392B
SHA256 2578f8faac9080d524335afdb5c4f03e65b84a454059878b4f67c7ea0f8d4e37
MD5 fad5f2604bb4b47e9234a674b1d53007
SHA1 69a1981b724ac548be01e43cb74f1595331b3f8a
SHA512 0cfccc53a9e5ff947bd7c85d16305122c2711f4549adfed35f1a85a2d93735f8e4fefe2bf5879a7512cc27b2934c8d5d46001d00430198e48d3cd6a8fd05ba52
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

07288ac2-97eb-4456-9cb4-4963ed0f6ed6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\07288ac2-97eb-4456-9cb4-4963ed0f6ed6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

68b213ed-2677-4127-ab35-6e60f06169be.tmp

Path C:\Users\Admin\AppData\Local\Temp\68b213ed-2677-4127-ab35-6e60f06169be.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsj7314.tmp\modern-header.bmp
Size 25KB
SHA256 8ddea157da0135a978a475b844f31140e80a7914d3bcaf17dd6f4346e640f7fe
MD5 f1928d020ebd3bf2c54fb46b3253f2a9
SHA1 420e69ca73d27306dde5fb79c3421b19bf089f1d
SHA512 9930cf22d313475a01ec6c9d5c916c1326699e7dd94c55791702b432948aed54dc4100d8e86aaa89549166a6616a49aa47fbba5a646f22f33b08b92ca474c813
SSDEEP 96:9uEW+fNQVVenO/7oTieu8RGGPv/DFYsP:NZlaVB/7eieu8RGGLd
TLSH
T140C2E9AEB933693ECD9911B41164A7FD8B302C5C7A40666E411FF8DD0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nskF559.tmp\System.dll
Size 12KB
SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
MD5 67fc1324e53b1f3854557f23b0c22654
SHA1 d36528a0468951a90a67a8e71881eee655d65c7c
SHA512 0fe91fd5e2267c3f21712f0a921539a13868e57e0f5444d86704a3e3ca15e383130ece5433ff9948e8772c777c401270ccfa99eab65527039333946ff662f4e4
SSDEEP 192:K5zfH361apH705aW7DSGb6KVFEc+Js68XDEKjbR493oJZnxxYCBm9:K5zfX61apHg5a+SIJFESACGISCm9
TLSH
T1D4424B5AEB72207BD01385BD9795E107D335B8DA79E0974F0AE8AA3A2F137902C5434E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nskF559.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nskF559.tmp\nsDialogs.dll
Size 10KB
SHA256 abd16682aa1531229e5aa727dda379050f66bd788c12fe61a38551f96dfcacb5
MD5 b9cf10930a5144fdda9479613ee3c84b
SHA1 5110556ff6ed1559c73cdd444f6e2408db570653
SHA512 bb9947763fea6915e90e662438d1247678576ff944f9918dcbb0c93d669f8a0dd7dd60db95f53e52faf1e0d3d627789cbcd6196441113556acaa6711b6b6f350
SSDEEP 192:VvvwccHJBa8oStSigfl6dblJDBUorNuCjLUoaTOt37Eezqm:VvvwVPa8oStSTUDiorNRjwoT7EeWm
TLSH
T15C22E85BFAA4D2EEC4974136D5BB5B06CBB170125692DA4E0B3096897F233433A2D74C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nskF559.tmp\nsExec.dll
Size 6KB
SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
MD5 cf0cac49c427a501d7806033941a6da1
SHA1 92acf906cc962b7e4c4138aac8ecec67c9629b4a
SHA512 7ad31611d7c0657d70318c16c781b7da793c8a19e4dfafcc90abcd4c8eb0dbad3aacf643b558b573502e50f504bb9f384b4df95f0db840e68763f03a7d8e85d6
SSDEEP 96:wC66T7ItPQcwPbfTA3Ck3lKYHxFYSdt4RTUR+4nz:dT7+EEjje4
TLSH
T15CD1CA2AA7C102A8C82F51F0A93F4A07EBA5308125785A3F2A688C0E4F53AF1737C745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4244_1608602562\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamTools.lnk

Path C:\Users\Admin\Desktop\SteamTools.lnk
Size 1KB
SHA256 68de7ff38811cc151647333d8edc25fbc0fd869353399f164c5b219d337dc41e
MD5 03e98b560cb26a9afa3cc84dc7bacfd3
SHA1 bfeee7cf29d3a99fa131f17459e41006d7026c25
SHA512 fa5c3dd08cab80d0dd597edf6a2fe22a4632f180a39946b15483e7a12e2799383f1e90d372d3a7150cbac00003e5a0745cdaa0f61ff174133a59844d1548e929
TLSH
T19E11004816FA066DC1F7D43DA9711B232336F942760C0F7D81CA82850CA5B00A49CF53
MD5 SHA1 SHA512 TLSH

Submit Download

SteamSetup.exe.crdownload

Path C:\Users\Admin\Downloads\SteamSetup.exe.crdownload
Size 2.3MB
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
TLSH
T11FB533116FB8D076DAE20F71E0FA86F79536FC15962A4F4B3A807B2F7835110A5047B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

st-setup-1.8.30.exe.crdownload

Path C:\Users\Admin\Downloads\st-setup-1.8.30.exe.crdownload
Size 10.6MB
SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
MD5 54cceb7c9c0c50a9d2f0b1b4f173eb33
SHA1 ffc28139e6c2d2eeeb27bc39f2ab20e4b8b4c08e
SHA512 41a589e7ea52d1a8730a4f12ef3db6e5738cb426f38483e8dc178e42d3ef58e1459cc61cccab800891f38fc9e6e3eccc76c46c2782108d084d91234b1f43b53d
SSDEEP 196608:CW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7YD:7CDQaC28nl78Kg6zCWCdFs
TLSH
T1C0B633942474E24DE0BA0031EC61EF66DDF4B09A5B058A1E4299CB6577E4BE34C2FECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2504-396-0x00007FFA02910000-0x00007FFA02E51000-memory.dmp

Download

memory/5896-306-0x00007FFA02910000-0x00007FFA02E51000-memory.dmp

Download