ratonrat | a8ba25a210943ebeb47637a2cfc9f4f2ab2638506124c00e740d726b9069a76f

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exodus Larp Wallet 1.1.1.1.exe
Size 3.5MB
Sample260629-yr68caft4l
SHA256 a8ba25a210943ebeb47637a2cfc9f4f2ab2638506124c00e740d726b9069a76f
MD5 df20e28812991a3607a8e8c76d09944f
SHA1 4cb9812c264bc7e727d3577d4b0f5a9c50496494
SHA512 b6856bbdaa406e5871b7a26292c0d449e84302d7215c806434de4d1e3be54c9cb1c21e5c880bbb9f0215d19e810ea8710eaae1d27b60fdb68f290dc717153246
SSDEEP 49152:dmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sj:Gq0WgVUuHjkDGjYQeqpgmltj
TLSH
T12206CF407BD0CE1BE19F87B6B4F2061057B5EC15A796E70B2E90BAAC1CB37445E1839B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution ratonrat persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

v4.0.0

portbuddy.dev:40644

Mutex

qMl58ePiPxhRRjbwwOJuXYv

Attributes

assist
false
box
true
box_icon
Information
box_msg
New version of larp exodus (1.1.1.5) is out.
box_title
Old version of larp wallet
defender
true
delay
0
hide_file
false
open_website
true
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://discord.gg/5Ta5nKpc

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/2516-1-0x0000029F63FD0000-0x0000029F6435C000-memory.dmp	family_ratonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3696	powershell.exe
3696	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
46	discord.com
47	discord.com
49	discord.com
52	discord.com
54	discord.com
56	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_689482572\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_253317114\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_253317114\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_142847230\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_142847230\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{E04C9E5A-0B23-4E32-9618-41E80E070C06}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{F8B8D8B1-A617-4DD5-80A2-42C4C62995A4}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
2516	Exodus Larp Wallet 1.1.1.1.exe
3696	powershell.exe
3696	powershell.exe
3696	powershell.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
5096	msedge.exe
5096	msedge.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe
2516	Exodus Larp Wallet 1.1.1.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe
2216	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	Exodus Larp Wallet 1.1.1.1.exe
Token: SeDebugPrivilege	2516	Exodus Larp Wallet 1.1.1.1.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeIncreaseQuotaPrivilege	3696	powershell.exe
Token: SeSecurityPrivilege	3696	powershell.exe
Token: SeTakeOwnershipPrivilege	3696	powershell.exe
Token: SeLoadDriverPrivilege	3696	powershell.exe
Token: SeSystemProfilePrivilege	3696	powershell.exe
Token: SeSystemtimePrivilege	3696	powershell.exe
Token: SeProfSingleProcessPrivilege	3696	powershell.exe
Token: SeIncBasePriorityPrivilege	3696	powershell.exe
Token: SeCreatePagefilePrivilege	3696	powershell.exe
Token: SeBackupPrivilege	3696	powershell.exe
Token: SeRestorePrivilege	3696	powershell.exe
Token: SeShutdownPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeSystemEnvironmentPrivilege	3696	powershell.exe
Token: SeRemoteShutdownPrivilege	3696	powershell.exe
Token: SeUndockPrivilege	3696	powershell.exe
Token: SeManageVolumePrivilege	3696	powershell.exe
Token: 33	3696	powershell.exe
Token: 34	3696	powershell.exe
Token: 35	3696	powershell.exe
Token: 36	3696	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 5508	2516	Exodus Larp Wallet 1.1.1.1.exe	87
PID 2516 wrote to memory of 2216	2516	Exodus Larp Wallet 1.1.1.1.exe	91
PID 2516 wrote to memory of 3696	2516	Exodus Larp Wallet 1.1.1.1.exe	92
PID 2216 wrote to memory of 2204	2216	msedge.exe	94
PID 2216 wrote to memory of 244	2216	msedge.exe	95
PID 2216 wrote to memory of 3172	2216	msedge.exe	97
PID 2216 wrote to memory of 3172	2216	msedge.exe	97
PID 2216 wrote to memory of 4456	2216	msedge.exe	98
PID 2216 wrote to memory of 4456	2216	msedge.exe	98
PID 2216 wrote to memory of 4776	2216	msedge.exe	99
PID 2216 wrote to memory of 4456	2216	msedge.exe	98
PID 2216 wrote to memory of 4776	2216	msedge.exe	99
PID 2216 wrote to memory of 4776	2216	msedge.exe	99
PID 2216 wrote to memory of 5988	2216	msedge.exe	96
PID 2216 wrote to memory of 5988	2216	msedge.exe	96
PID 2216 wrote to memory of 5988	2216	msedge.exe	96
PID 2216 wrote to memory of 3684	2216	msedge.exe	101
PID 2216 wrote to memory of 4872	2216	msedge.exe	102
PID 2216 wrote to memory of 3684	2216	msedge.exe	101
PID 2216 wrote to memory of 3684	2216	msedge.exe	101
PID 2216 wrote to memory of 4872	2216	msedge.exe	102
PID 2216 wrote to memory of 4872	2216	msedge.exe	102
PID 2216 wrote to memory of 1304	2216	msedge.exe	104
PID 2216 wrote to memory of 1304	2216	msedge.exe	104
PID 2216 wrote to memory of 4920	2216	msedge.exe	106
PID 2216 wrote to memory of 4920	2216	msedge.exe	106
PID 2216 wrote to memory of 1200	2216	msedge.exe	107
PID 2216 wrote to memory of 1200	2216	msedge.exe	107
PID 2216 wrote to memory of 1144	2216	msedge.exe	109
PID 2216 wrote to memory of 5300	2216	msedge.exe	110
PID 2216 wrote to memory of 5300	2216	msedge.exe	110
PID 2216 wrote to memory of 6020	2216	msedge.exe	113
PID 2216 wrote to memory of 6020	2216	msedge.exe	113
PID 2216 wrote to memory of 2404	2216	msedge.exe	114
PID 2216 wrote to memory of 2404	2216	msedge.exe	114
PID 2216 wrote to memory of 2404	2216	msedge.exe	114
PID 2216 wrote to memory of 4548	2216	msedge.exe	115
PID 2216 wrote to memory of 872	2216	msedge.exe	116
PID 2216 wrote to memory of 4548	2216	msedge.exe	115
PID 2216 wrote to memory of 4156	2216	msedge.exe	117
PID 2216 wrote to memory of 4976	2216	msedge.exe	118
PID 2216 wrote to memory of 4896	2216	msedge.exe	119
PID 2216 wrote to memory of 3988	2216	msedge.exe	120
PID 2216 wrote to memory of 3988	2216	msedge.exe	120
PID 2216 wrote to memory of 5864	2216	msedge.exe	124
PID 2216 wrote to memory of 5864	2216	msedge.exe	124
PID 2216 wrote to memory of 3324	2216	msedge.exe	125
PID 2216 wrote to memory of 3324	2216	msedge.exe	125
PID 2216 wrote to memory of 5056	2216	msedge.exe	126
PID 2216 wrote to memory of 5056	2216	msedge.exe	126
PID 2216 wrote to memory of 5096	2216	msedge.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Exodus Larp Wallet 1.1.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\Exodus Larp Wallet 1.1.1.1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Exodus Larp Wallet 1.1.1.1" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Local\Temp\Exodus Larp Wallet 1.1.1.1.exe\"" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/5Ta5nKpc
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffbd4f5c188,0x7ffbd4f5c194,0x7ffbd4f5c1a0
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1716,i,13914283835159231144,13875475968532343018,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
    3⤵
    - System Time Discovery
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,9315785435597396736,2891561792904293655,262144 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
    3⤵
    PID:5988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,16636116591370032173,3615996320232661649,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:13
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,5876154872225501477,12757271449888951663,2097152 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,240165556783297919,2105749251223807072,2097152 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,13328667293115973544,6543743673347382884,2097152 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
    3⤵
    PID:3684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,1806519465229996458,3342485847254861508,2097152 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,2272587689846242497,5910215068417026589,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,6024121213765703213,17356986233229660889,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,6703777728083629899,6415159590316025043,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,8645986226156377231,15125754642956386891,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,8645986226156377231,15125754642956386891,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
    3⤵
    PID:1144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,2307802888582678415,17887384800497305322,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,7614510205453118363,565407395917844450,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:6020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6232,i,8195578893229774507,1873185479581968075,2097152 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,7932592017484662594,17334344134273256352,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:12
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,4154132084499673322,4807678468892022267,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
    3⤵
    - Modifies registry class
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,18343147905276982429,10180518853301762306,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,9711451374481088438,6228717293944030485,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:14
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,1540761477470040441,16213907832710915680,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,12079941993890014784,15267489901962519612,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,5820981128679043985,1710142298453357239,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,9122348380973465351,161623631416002515,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
    3⤵
    PID:3324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,18286301613295699022,9400043305003716965,524288 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5824,i,16345967732797411693,12205074849666899634,262144 --field-trial-handle=2460,i,2541251604713187308,12711219713477274960,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\Exodus Larp Wallet 1.1.1.1.exe'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3696

C:\Users\Admin\AppData\Local\Temp\Exodus Larp Wallet 1.1.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\Exodus Larp Wallet 1.1.1.1.exe"
1⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d662d1d7cfdc43e590a1d5bb6d3efd39492d89f974e348cff1280a588d510651
MD5 ae553437fc37b2f401fc25d608307dd4
SHA1 f23bbefe8184ebaeb94baeac6716567e7c2ea2d1
SHA512 9a1e7b80f2fda381b0ce7a9ef21760dcb21237541bf6ce1f2f4c91e54147efdfb7f68d01b4d8df0924517bae75d42684bc37e7acf07ba2651c17f01313f54587
TLSH
T1CD613EA41A73FBADC32500B95AF320B97FB0C676040F6E1E428CD57417DAF1EA092631
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 2c9aa3dc114798fa80fe31b48e44be36bfaff8e0a4a3d07a9e6e76145e7f0ade
MD5 bd8acd1542d0bff7b1899b80dd902596
SHA1 f011b77b0480c8d1968d1cebf0627455b02f23d3
SHA512 2a1eac9049c9dd573d20c38626da50905eb62274cae28cff511217b8a6d0e1e04abbe6fb39982ff7ef8575d6f0470cefef934645ae30e1d4421be6ee7d9f0564
SSDEEP 192:xWYS2hI1HamVRbx07lZ6aD3Xe7amUVluod8BaePEKRCjiOgdTcqHlWyV1/yD+kci:xWYvhI16ERbx07D6Y3O7amUVzd8BaePO
TLSH
T1D4E1B7945736FBDBCB21007A45EF60743FB4D63A004F2E2E47288E7496AAF8ED002271
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5958d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5958d4.TMP
Size 3KB
SHA256 55c9374ec79d366bd5abe35754be5bf0f50ea1437b90d1f90325bbd14461ac4a
MD5 a5e21f1f5aee2a850d4a2385609711ad
SHA1 74b4fdc3e858f146d23f16f546775cacd2af223c
SHA512 07bb7e45c385c10d3f3d13d2c5bba935c3a07a1833c2b557086aa48bf02080dfa39ed4579a9bddae08920c494bb23ce1954009e9ab55e03cd06ede96de784b99
TLSH
T151613FA41A73FBADC32500B95AF351B97FB0C676040F6E1E428CD57417DAF5EA092631
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 79dadf38392627318fe0e21b9020960eb1847c4cdfe76d5ef7e497d1a7ae5ac0
MD5 e8ed5ed69c58b728cf042a5e844c6e87
SHA1 37173bbbbc1e9b412977da46f57e823e3bc8d78f
SHA512 ff41aa28182002e7f4f1c0e2154c31e30f6bc4541a9683a46bffa8fce935c2d851a3a52bc830764c4c91b6f524d2067cf6d8dabc3e9954d912417ca64c4a9881
TLSH
T14A819BF7C7E8862DCA1156F0AB187E2BCE2D0954432C3D6AC8E49F5B93E3471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 32e62e2cc01138be2ee1fdfe14bf74dda1c0386110884cd135ccb4563481fd30
MD5 664ec87cd1ce2fe80bfdf0dc1d754e92
SHA1 d280c78be5461c27a98eccb3263983808f57a7a0
SHA512 1e20c5cdab545fe4aca60d9adb708fa3281888215facf7da665191307a12b6eab5ca629ff2c481d7148c0ae233d350863b1498aa53a4ca2e68c21e039fffdedc
SSDEEP 192:sxRARZyM/jK1Ml8wcg/fysRvAdZYGEzoA8pi/g6+WNIYyBJtG08IgtJ:sxRA5Cg/fysRvATnli/5IFs3
TLSH
T13752D915AA24993BCCCBD209FA557F53D6F91563A2901E48AEFC8A1C01E76DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ba510315120334e3ff77616441a68f38117021d6246604093b277a8f17c1ef38
MD5 fe163509d09abef9f3f891784d2e069e
SHA1 4551c2302d2c08c703523c61a1df14fcb79eed66
SHA512 7ded3c8137324cc6e8037bc3d56d9f1041b4a2d344738a3866116778b5a0638641d2cbb93cdb023429f7555a3c8accb332bce9d99331d957accbc9936d11d355
SSDEEP 192:sxR3RZyM/jK1Ml8w2g/fys3vAdZYGCzoA8pl4L/g6+WNp4aEl/eBTyJDJtG08Igc:sxR37Yg/fys3vATnPqL/52zl/eGlsc
TLSH
T14062D916AA24597B8CCBD20DFA517F53D6F91563E2900E48AEFC8A1C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 52717c96a81e09f544c2a81c5371172cbfc844cd99f674a8d6ce30e5a915c794
MD5 a51898b33c1155abb334a5b27f3663b6
SHA1 1b56b22a471c256da5e2692c62eb4c2dc242435f
SHA512 682cbff133e3e9f1f54bc55a07d2e2c3bf18303fd077ede23c60e1d6e085b06a98d0a603c99ced3c06c1368068a7ec5763ae05184c29849f8469ccce6aec1220
SSDEEP 192:sxR3RZyM/jK1Ml8UQU2g/fys3vAdZYGCzoA8pT4L/g6+WNp4aEl/eBTyJDJtG08c:sxR37qdg/fys3vATnP8L/52zl/eGlsc
TLSH
T15B62D916AA245977CCCBD21DFA517F53D6F91463E2940E48AEFC8A1C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 da4da79d3ac2f8cf51d74b237f8c5813c74a680001de7b631c3f2263afdeae6b
MD5 fd8c3ef22b2019e32bea07415cdc9aa1
SHA1 eec4166ad99b7907257228ee2b9cf684b28cb081
SHA512 bb12dd9d8ca653e2df8fd54300033f475d5c3932d12d6ad3c8c96bf9635a28922f4453461eebc7c7f22ad174fbdf064c6a9fca6ea31185e5925d379d78580f44
SSDEEP 192:sxR3RZyM/jK1Ml8w2g/fys3vAdZYGEzoA8pi/g6+WNIYy2JtG08IgDkJ:sxR35Yg/fys3vATnli/5Iqsc
TLSH
T19952DA15AA24993BCCCBD20DFA557F53D6F91573A2901E48AEFC8A1C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b729e1e2b1510d0d5121dc154ffb7f420dbe057bf9ef99cb1109eca0128f543e
MD5 b4bdb71d5bc14be83739fb92ca802e6d
SHA1 83796c0a45495855eb7d75fcd198fc01d94b96f9
SHA512 5ecdbda9f47f12c1429befa276ce269d3a494bc86f72815837b4ed7b41d981a8668d25a47a9061976841a3b9020e40a32fdf619693dba3e5ca4a796a989f2d9a
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVELgcciQro5Ilk0:AIox/OE7p0WguMfnAu1jaXLgXi75IG0
TLSH
T124E2DB3B680CCB7E4F804A9CEC29BE9E6DA801CF96D8CD5447FA841C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 c09167de218de8f8ea57c15f3f73e7453ce5de5e6c3c1bee4c44e76a8d9f7f18
MD5 6acede4439198b9febb7dc6cb4928dd4
SHA1 b54385fa886aae476de20397706736bc20000339
SHA512 039df80dc260055a85586487dbd3fd7e7c192609d1f358160bab287a5939e0a6e24e4d7f81a63b8a6141f85cedff3d075d5efe965ec542e7ccc595a36f22c8f3
TLSH
T179D0A7DBE4A60450D7A70E815B32157A8BE12CAC6DC5D5889142353E5CB8A47EB21F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 5eeb0e68decb422fb2a1640f4ab046bc1388535f4358092db46de5b02571e2d6
MD5 141ef0b93a4bb7eba845291c9445cf22
SHA1 4151154679f4939f32f277e269c78df57a1a88c7
SHA512 776ae0a07cb9d0458250718cbbaf3bc2f164d96128f3d746dfcecf20971ab85467cfdb91903e1b7f63b7ed4338a8b17236cd96c245b0267e9261f6ac6ddb3234
TLSH
T1A4D0A7DBE0954550D7AB4F816B22553A8BA13CAC6DC5D58CA041153EDC48A47AB12F92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe596af5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe596af5.TMP
Size 138B
SHA256 7f57977d215544e5a2ad52700d613d29b2cc380030e4736370239d6dd7b8610d
MD5 ae6fb97cd7bff86335fa0401d87d09b5
SHA1 342142f7386da3318650ee2bfa92ae51fcfc148a
SHA512 8997ad3c91f4965320d194b3e5a4956d8030432010c4c44f7ea67bcf83e02517cf599e5a18934cd10318179f7c4df2c1b96c60480be89d257d806a8890430dc7
TLSH
T1ABC02BF7A0420804C75206814633180D8B862CEC4DC6C5CC7093382E2C30F13B505FE2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b926ac815a59ab39754bebc07793f80a53613a05308c343e4076593af811f4c8
MD5 9a59514196991c6188b52815a7b5af48
SHA1 410a9cd1b07aafb1b8fc701ae321d146f4c4c752
SHA512 5fe7cd4b37d9350aba98fe44a2385cbf042016bbb3a10523aebb2326c37a07c1ce6b2ca98861d6fa9966bb6d5581c68bbe06ea83b32127a6dd03b04b8b4046d1
SSDEEP 48:Ks8IjK9ycPy2dKzXtn7fGzI2IvPfKYOwRf81PlQj/AFMQeiGUmCDfIT4UKURcGU2:Ks8AK9y2i6AKvKA7iKY46n
TLSH
T1D691739475FB2740383E245E827DE52E528131A630DEA46B3BAD60E12F27E048EFD5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f35f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f35f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6dfafa10abad3eb3cee5986d87b4455863cc664cc963021938a8e97f93120497
MD5 336ea4da52cd3af072704e5bc95a8f72
SHA1 0e98e7076341e535402eb7b3128f93c2a17e1398
SHA512 f184fb302c6e6f7ec5f488797f4159a3b7bc54dd82aeede124175e4871f1963e8c7e4d10e8308cdb7140d2fefe75264f36abd46c73fbf74e0e63bed01076cad0
SSDEEP 768:/rv+4UNbdV3TBc6QOJIwYRC/hUAFjQIMyOV3N5E9E4+8r0mz:/bsb73vhNFUIpONNmtDr/
TLSH
T1EA13BF31B9A5DEA35CFBE685BA1672837FF410A788C10A84C9DE5B4C454B2DD231FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 15cb20f628a2157ab2ea368a8f8e74d9e532dab0ebe77a02e36d70b3c461f4c9
MD5 50d20a6be57de1977f9e72e88c05205a
SHA1 8ec9a39b4821eaaac3eb0a96fdc32bc1740d73f2
SHA512 b5ed7556813e84d8c4ab24fa0cda082661e8c5bbda8e9a30f4fbf51c7abac32b985924cfe19c1c9a67bdef4d8118cb6a6d84ed2799e5ddd18812aaaf9cd46287
SSDEEP 768:cj+9H3eBc6QOJIwYRC/hUAFjQIMyOV3N5E9E4zn12bfJJ:79H3GhNFUIpONNmtByJJ
TLSH
T125F2AE72B9A1CFA31CEBD2C57B166287AFE411B784C51984C9ED9E0C45873CD235BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1d197e339a9061232a7cb5033d10e5a93784b5415cda6a60bb34961d081f2ee9
MD5 a482aeb4f5dbf4660b80f9c72db15855
SHA1 f1f540a09b5a0da6eb913be2b50ff5de0caccdae
SHA512 9151eed43d3f2419a496e02623ef78fd329093cbab8cb44e3792f0046f7fb846b4c03d4c5b785f6b7d83f1684b1081d6f8155b4b6562eb493263e212fa024a8d
SSDEEP 768:9rv+4UNbdF38pEQOJIwu/hUAFjQIMyOV3N5E9MZy+8r0mL:9bsbf3ChNFUIpONNmdDrv
TLSH
T19903C032F8A4DAB39CEBD6C5760A72437FF441A395C50A84C9DE6B0C824B5DD231BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c299ffc106b93c0d1687806cda3da12c8ae917251223e9bc1b5cc7033ea108fb
MD5 5a38ed12248c1ba69a25c2c1cb40e398
SHA1 152dd72f32454ce7133867b0f809d5b533cb10c4
SHA512 1c1ab0634b247cdffa1897ebb76cde1b5ea9b4964e1ae60a88ba05835af62ec56a33977a316251d1e3e50a714e9494abd4842215433d74fd45eba40e097dfc43
SSDEEP 768:+rv+4UNbd53XBe6QOJIwYRC/hUAFjQIMyOV3N5E9E4+8r0mz:+bsbP31hNFUIpONNmtDr/
TLSH
T1B913BF31B9A5DEB35CFBA685BA1672837FF410A788C10A84C9DE5B4C454B2DD231FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 05de9d53e1b21e17ac9d37ab66dcf636963d31fbfc16cb341b74c2d5b760e7e5
MD5 f2a8da2503ac20f163008420796bfbfc
SHA1 2a21ced6e4bbff72712dcf94b3eb0ffdd684f92d
SHA512 9caa91ccfa5c779d74ea059e491a2a883dbc430c5af98875f12313eea0b02d57d6f76a0858a8c64f1c53d9d61dd3c2fc4e5a4ef4d3d801d7e1f25b27df60b13d
SSDEEP 768:wFuj+9H3EwgHBuTrOJIwYRR/hUAFjQIMyOV3N5E9E4zn12bfJJ:+9H3thNFUIpONNmtByJJ
TLSH
T1A0133AF698D38A76D8AE8787673D6E469EBCC06374845884F7D95D0CCC822BFC34A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2216_510202516\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2516-11-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-5-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-10-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-85-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-0-0x00007FFBD9BFF000-0x00007FFBD9C00000-memory.dmp

Download

memory/2516-7-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-12-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-6-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-8-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-9-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-3-0x0000029F647C0000-0x0000029F647C8000-memory.dmp

Download

memory/2516-4-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-13-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-30-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-2-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-19-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/2516-18-0x0000029F7EF50000-0x0000029F7F2C6000-memory.dmp

Download

memory/2516-1-0x0000029F63FD0000-0x0000029F6435C000-memory.dmp

Download

memory/3696-82-0x000001E3F6100000-0x000001E3F61B2000-memory.dmp

Download

memory/3696-83-0x000001E3F5E70000-0x000001E3F5E7A000-memory.dmp

Download

memory/3696-73-0x000001E3F5E90000-0x000001E3F5EAE000-memory.dmp

Download

memory/3696-29-0x000001E3F5CA0000-0x000001E3F5CC2000-memory.dmp

Download

memory/4544-17-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4544-16-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4544-15-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4544-14-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download