hxxps://cdn[.]discordapp[.]com/attachments/1521465546703638678/1521465547039047760/fang[.]rar?ex=6a459775&is=6a4445f5&hm=91cfdbed2c9f9b2c7e61edf1b9a68157d97cb3e6ca41d96b6f9638cbabec28db&

Analysis

user interaction
yes
max time kernel
898s
max time network
736s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1521465546703638678/1521465547039047760/fang.rar?ex=6a459775&is=6a4445f5&hm=91cfdbed2c9f9b2c7e61edf1b9a68157d97cb3e6ca41d96b6f9638cbabec28db&
Sample260701-e8wcmaev2q

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6132	fang.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4372	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273542435891315"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{9CC6A6EC-B5BC-4576-8B19-2CBD88676AE1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6132	fang.exe
6132	fang.exe
3228	msedge.exe
3228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3588	7zG.exe
Token: 35	3588	7zG.exe
Token: SeSecurityPrivilege	3588	7zG.exe
Token: SeSecurityPrivilege	3588	7zG.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
3588	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6132	fang.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 3492	2892	msedge.exe	84
PID 2892 wrote to memory of 4372	2892	msedge.exe	85
PID 2892 wrote to memory of 4556	2892	msedge.exe	86
PID 2892 wrote to memory of 4556	2892	msedge.exe	86
PID 2892 wrote to memory of 4556	2892	msedge.exe	86
PID 2892 wrote to memory of 4472	2892	msedge.exe	87
PID 2892 wrote to memory of 4472	2892	msedge.exe	87
PID 2892 wrote to memory of 1332	2892	msedge.exe	89
PID 2892 wrote to memory of 1796	2892	msedge.exe	90
PID 2892 wrote to memory of 1332	2892	msedge.exe	89
PID 2892 wrote to memory of 1332	2892	msedge.exe	89
PID 2892 wrote to memory of 1796	2892	msedge.exe	90
PID 2892 wrote to memory of 1796	2892	msedge.exe	90
PID 2892 wrote to memory of 3420	2892	msedge.exe	91
PID 2892 wrote to memory of 640	2892	msedge.exe	92
PID 2892 wrote to memory of 3420	2892	msedge.exe	91
PID 2892 wrote to memory of 3420	2892	msedge.exe	91
PID 2892 wrote to memory of 640	2892	msedge.exe	92
PID 2892 wrote to memory of 640	2892	msedge.exe	92
PID 2892 wrote to memory of 2480	2892	msedge.exe	96
PID 2892 wrote to memory of 1624	2892	msedge.exe	97
PID 2892 wrote to memory of 2480	2892	msedge.exe	96
PID 2892 wrote to memory of 1624	2892	msedge.exe	97
PID 2892 wrote to memory of 2344	2892	msedge.exe	98
PID 2892 wrote to memory of 860	2892	msedge.exe	99
PID 2892 wrote to memory of 2344	2892	msedge.exe	98
PID 2892 wrote to memory of 860	2892	msedge.exe	99
PID 2892 wrote to memory of 860	2892	msedge.exe	99
PID 2892 wrote to memory of 3152	2892	msedge.exe	100
PID 2892 wrote to memory of 3896	2892	msedge.exe	103
PID 2892 wrote to memory of 5680	2892	msedge.exe	117
PID 2892 wrote to memory of 5460	2892	msedge.exe	118
PID 2892 wrote to memory of 5468	2892	msedge.exe	119
PID 2892 wrote to memory of 5552	2892	msedge.exe	121
PID 2892 wrote to memory of 5552	2892	msedge.exe	121
PID 2892 wrote to memory of 5592	2892	msedge.exe	122
PID 2892 wrote to memory of 5592	2892	msedge.exe	122
PID 2892 wrote to memory of 5592	2892	msedge.exe	122
PID 2892 wrote to memory of 2704	2892	msedge.exe	123
PID 2892 wrote to memory of 2704	2892	msedge.exe	123
PID 2892 wrote to memory of 2704	2892	msedge.exe	123
PID 2892 wrote to memory of 3016	2892	msedge.exe	124
PID 2892 wrote to memory of 3016	2892	msedge.exe	124
PID 2892 wrote to memory of 3228	2892	msedge.exe	126
PID 2892 wrote to memory of 5772	2892	msedge.exe	127
PID 2892 wrote to memory of 5772	2892	msedge.exe	127
PID 2892 wrote to memory of 5780	2892	msedge.exe	128
PID 2892 wrote to memory of 5780	2892	msedge.exe	128
PID 2892 wrote to memory of 5876	2892	msedge.exe	129
PID 2892 wrote to memory of 5876	2892	msedge.exe	129
PID 2892 wrote to memory of 1424	2892	msedge.exe	132
PID 2892 wrote to memory of 1424	2892	msedge.exe	132
PID 2892 wrote to memory of 5228	2892	msedge.exe	133
PID 2892 wrote to memory of 5228	2892	msedge.exe	133
PID 2892 wrote to memory of 1524	2892	msedge.exe	134
PID 2892 wrote to memory of 1524	2892	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1521465546703638678/1521465547039047760/fang.rar?ex=6a459775&is=6a4445f5&hm=91cfdbed2c9f9b2c7e61edf1b9a68157d97cb3e6ca41d96b6f9638cbabec28db&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffa0554c188,0x7ffa0554c194,0x7ffa0554c1a0
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,274965969379339832,9920641260137664822,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,9326404322490715830,5844672051835790995,262144 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,14203969793917301847,3634602630131912117,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,10051950306710029344,13046647105003040052,2097152 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,7932359209986533693,16002696311103636391,2097152 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,8430590399075197383,4546764951939322967,2097152 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,14284414589853559377,8920532470800248626,2097152 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,6313446757491092390,10335883123595982756,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,4444969535558907183,11278450995295851997,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,1821911513846457530,2310458689351022065,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5680,i,9876259478152034559,2623878290604299533,2097152 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,10119790692629341773,16250821997867851654,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,17251551220730606564,15794288176800857930,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,17251551220730606564,15794288176800857930,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,15503585857079971859,2263743181849950104,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,11875210911626914741,10396084336055417903,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5947763026996797518,3905204483048069383,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,13390412579044485829,188807331835881649,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5244,i,819253739448647708,1619421995041556861,2097152 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3728,i,5108139999045933159,14415674292978970283,2097152 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,563417126100534823,17522379510301645181,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6700,i,347041175043691083,6833840579927451634,262144 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,2243500629747187829,14710018946003676989,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:8
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,15057127849620972619,3544936489101599812,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,18336234529204283516,15090365494417771040,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,5491282174808488784,18245598790358667740,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,8732464586345779103,14175921487837918793,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,16558047707759729097,6202953978370147259,524288 --field-trial-handle=2192,i,3917578684250953542,18049502516669257765,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4444

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\fang\" -ad -an -ai#7zMap15754:70:7zEvent5699
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3588

C:\Users\Admin\Downloads\fang\build\fang.exe
"C:\Users\Admin\Downloads\fang\build\fang.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e3e85a1e046393a00d10e8351ea3fe95b1fb0d524da6f971fb76b8be0a5a69f2
MD5 2b03dc277080b9e30f8d0b5b2ea2f986
SHA1 f47519e94b71c7d53b4d89a77d2e221d159e415b
SHA512 17d9ff27d9f1f732e312375255bea9ee4eb05b3d8625dfa869c70c50ec40680e613506d9d840672831668abcf50cde8997f5dc4aa3ead7254fb269323958cf72
TLSH
T1C4E020881BC4C31D9781E487825C434C41D1F75F92C4ED556B2084ED734105067D5DF4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 09f0057b1581644e11f05e1fadb6472265fe9d242ddc37683c9dd2f293df1241
MD5 20f97844c3bdb3ac1ccae86b3b33e457
SHA1 46b7ec2b2a0a72d5cf86a7c2e535cfa3f295fd7d
SHA512 f294b75ca0edc35776897a55f70928f61828e04504b4ea4fc286a2d441acd4b59d66063056f468b14302a9e02d20ad48bb3f023b7b5c54e560c60b45dcaa69e7
TLSH
T1A4E020C85BC4C61E9360F5C7C3F4438C41C4372BDBC4B9095B20C4583001A54BBD9BE5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 59e11d7ea955650342b0317e6333d4054bbd2bfbb37b2db33d82d6203c0f25b3
MD5 d9cc4163ba3a17b040752921d69963f2
SHA1 30145209bdd20a1f6472d311654bda48fe71c1f5
SHA512 0167304e6b919cad7c6d182a1d0e34504e371548178b9449b6ad12da5194dc543e3f38a7cad034b21c3d1e5f96f62ec522c8735b8b0839e1071e8a4d3a8c578d
TLSH
T13D71B236222100E3FF31417239C16201F97DACEEF6AFEF2A4964D4B71C69712D1A9918
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 9766906d8aaabf86702540f976c99f43735d764534112796e6ea15bc499e24bc
MD5 a0ef87ba3e58196e6485923e912385c9
SHA1 a65e1d4e7f65774cbe245309a5e869ccbb523105
SHA512 f4d5e1acabf26d0457fb03887d9184798d39924e71c46f619c9719de8f061459821751c84a651334f2ed9f0364e57fbc5b93db141d182375f90535e5bfe907e5
SSDEEP 48:u2fggQC4oNu41R+xPTOSl/2UVTb7eaZ+8lZIjZWHGJIUe0JpYlXzVs3blAv8yO9s:u2iC4HW8/n7U5lespYtVql1S1DIE
TLSH
T1A0C13936232C30E3FB654CF178C15210B939ECEAF66FEF5A482487761C53705D595468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5874dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5874dd.TMP
Size 3KB
SHA256 89669bc8895c6b70c9fa8f2cd269437d671b6aa4b6ac4bd74e28af92232fae9c
MD5 e0b1bb9cc728e85f0f520e24d7612e1c
SHA1 32c87b487fca5fac681fff9feb2faad18bb73c29
SHA512 9d6afb78ca3009164e455324245f263fe50bc88aba9be539d34307def5e287b21d0ba609652be07f14d9e6970801a787692d1cd6c143c51e62952974f40a6c35
TLSH
T10571C236222100E3FF31417239C16201F9BDBCEEF6AFEF2A4964D4B71C69712D1A9918
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5c4c7298ed2f8ad293897effab7d9fa1af688eea92cd3f89a6a0bc69c1f9ab78
MD5 3b16690f029d1e2e31f0eed982172349
SHA1 add0251a87b01050a52c8bfe0c8778fd42aea4ce
SHA512 b18ced8dca88e12df331a4217a96cdae1035ccc6cd7cb48758c7e791cc9a6584579d21a369118d88c444bdf4f42b3a6baef287c06629316e82f5ef7abd8bf636
TLSH
T1AD519CF3CBD9826EC91116F0AA287E1BCE1D094583283C1AC9D4EF5BD3E2471E156E5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 28ec59c1a9ecbe9e3d5463fd7599f0a33300615ebac3b41e3f000682c771357b
MD5 20390c4cef06b34271ced3535cb780fb
SHA1 969fa704b12af66fa9a1e7cdd9a599e93b1067ff
SHA512 ac1b7fd83367aa25cd3b67f72ded5d2d51624224cf093e7e0e5699d93826c9692f145c9b28ef4db308f8a26646afc373f6fb1e4820725232dee767751026cce2
TLSH
T145519CF3CBD9825EC81116F0AA28BE1BCE1D094583283C1AC9D4EF5BD7E2471E152A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 baa00410dcc2c5c823b9b83b0e0d07ea64bd07204d9cdca95b58cb9e5cee3346
MD5 3a2764877386c7108c4ee11062beea15
SHA1 47a239b9411def4ac17842a265cb742732fcfd44
SHA512 a473d1f7ee4c788137d34be6d8451d82b306085f2e9d074f1f15ddc3c92d303b45d08bcbb5485fb2eda53d411818897fb985b8375c6f7ffeec9999519e29a467
TLSH
T101D02313170330B55A7CFDD14056BC4FCB3A10500542DDDD51D0949C1A3547E550B240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe591b4e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe591b4e.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4169e3dfd562e8c94943bea10a676456b865a48eb585f472c2a37f0a64846444
MD5 f98ce0a7a7d6a7e7f354832363b42c99
SHA1 9bca35f44874dd46b4b3d007f45d0fcce958723c
SHA512 88b9588d2ce798cbaede28f9257dc6e6f2d99f6c4f08c4846f122d1198cb76621653f806582f42dccbae7a0b775c09314e56651216745c5b43e04260c3d4c572
SSDEEP 192:sxZVcERI5yM/jK1Ml8M9YP/f4xstAjqbJIdpJHW6+WNGYIwVdE3utIgrJ:sxZPO1E/fAstQDJHbGO9
TLSH
T14042C712AB34697BCCCBD209F955BF53D6F91472A2900E44A9FCDA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ce1e6620ee9711bb7bc17fa332a973814d789d236c9de59439c3fca72e121f98
MD5 95c55fa96bc61e8aa14c8350b7c926b7
SHA1 80cbe58dd63a1753053251e8fd67e4c8037c2af3
SHA512 35ab70389ff0c78104c3356636bbccfec9ea84cce92393e860a3fdf3f650c667ca3188100076cf8e8b0da045f34d76d16d763ab50f824508a8a1d880c9c6c5c0
SSDEEP 192:sxZVcERI5yM/jK1Ml8UQYq0cB4YP/f4xsYcA5qV7J2dp9VsVkHW6+WNiVj9/YIlM:sxZP2q8m4E/fAsv7bWXHbi/jVKKGsKe4
TLSH
T15D72E7526A24D977CCCAD509F935BF53D6F504629A510E4C5AFCCA0C01EBAFD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 0e3288ff37ba866fb920bbf6ad234af245061a69e4952d80c78d38fb57008cc4
MD5 88968ef2f2b1033d674eac3063696ec7
SHA1 9cc0802320531b5d495524cac56cd0b512c3b224
SHA512 39003924347d09ce55ca35e81f48b7e8a3723644a0670e82f901128da8e0078a89fc7c2744707da267f932fd4f2f6212fa2ef539db149472e83ac25ab0d70d8c
SSDEEP 192:sxZVcERI5yMqZjK1Ml8UQYq0cB4YP/f4xsYcA5qV7J2dp9VsVkHW6+WNiVj9/YIF:sxZPRq8m4E/fAsv7bWXHbi/EVKKGsKe4
TLSH
T18D82F7126A24D977CCCAD609F975BF52D6F90462DA510E4C5AFCCA0C05EBAFC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c15e343ca62eaa02f79019312b87ad2d5f55384600c619ad151198a38c83ac9c
MD5 0923a221bf0fb02f2f360af7b9333e50
SHA1 f27bc787673116f8a971e11ab479a46e6bba6ef6
SHA512 4d048f3bad95dc4c25adca1bdf752a9a30f120d23b22bc5fa068c52170a7356c4ecfc7244b6f5a2c57546a7cc18d993885b6464edc05c4d1fc6ecc88395f2fdc
SSDEEP 192:sxZVcERI5yM/jK1Ml8M0cB4YP/f4xsYcA5qV7J2dpTVsVkHW6+WNiVj9/YIlXVz6:sxZP2sm4E/fAsv7bWdHbi/jVKKGsKe4
TLSH
T10C72E6526A24D977CCCAD609F935BF53D6F904629A510E4C5AFCCA0C01EBAFD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b7a7a78bdb9c804cc557e5fb892dfaec12a6708cddf89354c97706e667bd27b7
MD5 29977f5941b649532acb589353d8a690
SHA1 75ff18e6cfe8642ad26aa665c217aefb208e4ddc
SHA512 0666ddcbac6d561e40283a1d8117db6efc3b5f8266ca1503571df315447fc997ce5e3d915b94f272a5ea876045dd1b5fcf1ab87a96574b8fc5cf99c8e7d621dd
SSDEEP 768:fzsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9oroKcj:fzsqxXlWvJD6Tu1ja54LAs9TKW
TLSH
T19DD20B3B694CCB7E4F840E5CEC266FD66ED801CBA6988D5447FA890C03CB3EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 0951f42a0b8a1cce98787fed02e0f474e3fd2920b887e91e736325893fb3228d
MD5 1b42e2c4cac9ae2ce7c2ed0feda84963
SHA1 b95ac29117291787073dc1d70a39e51682934a35
SHA512 ee91a181d10d7da3f535cba0797504db521e709a1e0461f64e9d85964683dd12ef4d04cb27a6e5142e22dd1a3d8665ad298dcef46c5b1aa2abf5ebf30fdf35af
TLSH
T1213175CD4E54999FDC9445B204B2657437B498CC2F15E2178C7C623A7C6337A2A5F1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d6a17.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5d6a17.TMP
Size 1KB
SHA256 36b38e85182b04d70a0a8774fdd93d2056091362db192647050baaeef639b74c
MD5 f6ea674079271fc6a6948030e9307e26
SHA1 766053fe4952e73b5377bec20fb847525732ad12
SHA512 cdf4f934ccde61d14c584d3909a4daa76111f068d018a418043fde218634818170ac77807421459f851fd620f0ea2523977c08179a1ef9a18c094869cf84a520
TLSH
T16C31B78A4E558A1FDCD000720593A4B43379D8005312B78794BC563ABCB67BD1E5E1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d13159348180bd0b5070c15cd8a3262879a963d6bbc10eece2242362f8f5f07f
MD5 1d316b947df04f21b2778c09ec4c48a1
SHA1 4f5be397cad6df3129799e5c13c469a56ea4cd95
SHA512 b0fdcd9585b8ed82bd8a58c5b05587a8bb33af12ade256be2a41cb3ea908b7329c6a9d8f173a841dc84d93b9c3be5a4c72cd7031e4991dc5b70199d1a77c9f39
TLSH
T1EEE06FBA2AEB0800A8ABC3EA187254A64410F828C891EC4F002AA28310622A02832C26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 5d71bb7fff47578581daf1f27c64999eaf160bdd6f020217cfd280c75a3ec283
MD5 916ac1931f00459cee57a4a0dad76fc0
SHA1 a804a077ecc78e1942b9493864b23fd2a54895e3
SHA512 acafbccad19c15676de191f6e738c2e87827e48116d114b396604d834d22618b283ef8f86a4fbc853b2ea8b84395c3217094990bfe90e10f0bc539bb8623f3f4
SSDEEP 192:ExN9uzCnTRZZEpojzzrhFYbzg18ldN+zC+4h:EnEzCnTRZZEpojzzrhFYbzg18Dz
TLSH
T10FE14A1636770202387E2908E39EC5779E5376633418E46F3BB850615EA7E226DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59111d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59111d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8d430561543a5beb4c5c5923f8e958bb69c3f6f809967eb51bf038a203e2e2e6
MD5 5252379728eabe4601a2cc72518f833e
SHA1 29a71dfa428155f0ffdfdbe97753b4be69ba0398
SHA512 a5ae55d07c3cc5177d9e1f121aca5cad2366ae1b61721e46e584b15789f6bcfe4a946d18596983386763a9d5669834828dac4bb09db0671c4311209dd3a23bbc
SSDEEP 192:uODc8UsNPJYXTQwLOkRbLe6TQmiU1VWVs6f54VRNNOmz+7R9R+2fSRi4q6ghU8:MsNhsDdbjCOVRNNOE+l9R+2ubWU8
TLSH
T15242F9326D286C774EE6A645B54B35139FB85067EB892F90D1DC5F0C02DF6AC230E916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 21bdf4e0e507a00f6c5b57df21dd5f9e233336620feca64187e97f193401d902
MD5 8048ca84ab0b9b1ecb40b19731eb038b
SHA1 ce53b5f398b063206fd97445629c5917d530a514
SHA512 5aaf43f235f40cd1d9fbee99e78b9841b8a2d406ca5409b7709e29c19a452b99ae25fa8cf76d0a3ee60a79eaf0f04dcae07dc2ae7ea2c6b233a9b5d7b7cc2115
SSDEEP 384:QiFKtNn/s3n9S99sNz8TUNTUlIleDdbNiOVRNNOE+l9R+2lbWX0IidKzvaY6Jc:rFKj+9ACwgRMHNOEI9Rll678KzaxJc
TLSH
T1F1C219F259D74C76C9AE4B47B73E2E078EBCC167B2415A50B3885A0CCD8A1BFD30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b528012c8fc483e8f29bf57b235a7364857dd905591634d6eceee6e6b857a084
MD5 a264c47ed8275387f39f29755c23f949
SHA1 0a02c9dc66f9f023f7f004e674a23d320c62ff5e
SHA512 3332f2aa62b5921ebc1905ace3ddfb240950ca64aff9c4d09d8500d3dab4959bccadebdefd185822d11ffeb581d5ca4b19d8c05e002e025703e9bff40303d7fd
SSDEEP 192:tON16JkRtQmiUyVPVlW+RNNOmz+ih3icRIU6:tON16Ur2W+RNNOE+6UU6
TLSH
T16102D8357D382C7B9EE26E09B58B27275FA9207BFA856F80D6D81F0C01D765C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 51f1115eb451a5e45d8d0fb5fffffdf7f3e15351ba81c8055a6c44288ec9be80
MD5 92d25ca8eda9745749d6febd868a9954
SHA1 6080963b839bfedea972aeb6aa369b808151e9d5
SHA512 8febb43dde1e68ff3ee613fc242d709224d75f706d30b2c32ab29f8b0a1748436f132f1fea8404c5ee584d0ddecf5d257a649438ab3aabec65e78bbf421ee6d7
SSDEEP 384:VtNn/s3n9SZsNheDdbNgOVRNNOE+l9R+2cbWX0IidKzvaY6Jc:Vj+9S+MHNOEI9Rlc678KzaxJc
TLSH
T116927C326D296C774DE69589F54B3A178FBC91A7E3852F90D1DC6F0C02CF6AC230A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e0259643d4c8e8dbdfe35c6ef96a92027dd8d0a3eed5db4a3c6f9c123c87cbc4
MD5 dec3bb3de879029a31586d2e39fdc699
SHA1 7972c2eb53eb8ebbbcff345425391664165d4bd1
SHA512 e88637aae6ae04db82cae134f92fdff0e8e84c3b646b303d4d1aab787d082accb92aa50c3120ec3e57b35f7495ae26db73f9cd15665b2db4384c996df141b6d6
SSDEEP 192:f5ONro6JkREHQmiUyVUVlfy+RNNOmz+7R9R+20Vci4q6ghU6:BONs6Uivq+RNNOE+l9R+2jbWU6
TLSH
T189120A366D285C775EE2A945F48B31174FAD1127EB8A6F90D1DC1F0C02DFA6C234E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b0c7b7249c114066f53d188336e74430eaae89431b556b1c401bd42b51520a39
MD5 2ff7a5033ddfa7e72c21781886acc4e9
SHA1 140914c9b04607f0fd73f3b644d602fbbc91e780
SHA512 79762a221ff03c343e1f72a36bfef824a03f896201bfeac933cb49e7b9b5519689cc1b162c9699a225dc773c5bde9cbab858167201e3b4a6627e15e5912f2464
SSDEEP 384:5tNn/s3n9SZsNheDdbjCOVRNNOE+l9R+2ubWX0IidKzvaY6Jc:5j+9SaMHNOEI9Rlu678KzaxJc
TLSH
T1E6928D326D295C7B4DE69589F54B3A178FBC91A7E3852F90D1DC6F0C02CF6AC230A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 63f9b69fad66c149704dbfdecbe033a2fbaeb8576af1ad5d3212bf2421872359
MD5 0720be295f7ba75d15c8615f62d97440
SHA1 c6e28e536b18953b9b68e0ac594c39bcb094c2af
SHA512 dd211c83ff96a6f3a1922873866df810bbf87f9c70dd0739bc1a4ffa5eb082a0595e5e9a211fb58cf5f7ea2f3c85eb0cfb522c7041f186b5fdad64fb1e172630
SSDEEP 384:WtNn/s3n9SZsNhnDdbjCOVRNNOE+l9R+2ubWX0IidKzvaY6Jc:Wj+9SrMHNOEI9Rlu678KzaxJc
TLSH
T12A927D326D295C7B4EE69589F54B3A178FBC91A7E3852F90D1DC6F0C02CF6AC230A516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f97cfcee8cf6ae78ac83fcf3311ff256860130b077bdae6148313ee9b3e9c549
MD5 db4ff8b099113bc2285984fb991f8be0
SHA1 9f14e46299c1609dcea2ec1078b20db02357ef2f
SHA512 30779c9826e0a933b3e0dd272f35198a2fa5a501e1051f65c07eb0e88546874d72fca3731c41aae248982bd87538a3146e4d66a61332f5102941f3cd92e8a0e3
TLSH
T11241F95CA6FD0148B7B76F56ABF6686E487BB8772E4AD45E10110E4F0622E40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

fang.rar.crdownload

Path C:\Users\Admin\Downloads\fang.rar.crdownload
Size 4.3MB
SHA256 4bfeef9309c9a0e6deadb08c0e83970162dbcd3585b3f01431767e3e85e0c9df
MD5 9bd28daeb7f4c3a275b40a0e2e4381cd
SHA1 8a9846d1f95c5412366f49398ec37f998492842f
SHA512 451f556a7409e91345021d91b0cdb585fef313633d3b1770085f04a3372d76f1336e61eddd1d34228431d00ed5dea5298f4d3f21d87bb21decf5caf2bd491b15
SSDEEP 98304:BKGc1znlAZDTqv7ffMSvB+g8N/xT/V1gRdJdJleXzHvvm7Rl64rh:opsDTqvbfRvBFe/v0JsXzHvvmb6Q
TLSH
T1392633C0463AF1A3480D5BDBE1A69F2D527100F67286C15E86D628F9639C24FE1BD3F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fang.exe

Path C:\Users\Admin\Downloads\fang\build\fang.exe
Size 1.2MB
SHA256 0e7dfc16a2feb990fc87bf822308f3d55c83fec9b0526a677bb8860c677f221f
MD5 9976c40e08b54249a2d8d990387077c5
SHA1 9cb7968efdbb210b9b57a1750edbbed246d12416
SHA512 43a1adb0ef0dbb34fe73687dbb4ecfbe1e7bff0d6ce97c167f93f6464bd62c3dd7d05f1c2339aa4e652ccc7f9ac86568e8f695efad9b75512ea17e025873e897
SSDEEP 24576:G2pInbs2W5tW9STxWElfR6vVK69N0gsI/abtTw9IKsZ3iRNnbji:G2pInbs2W58EVR6A0faJw9D7nS
TLSH
T12555BE42B2A542F8C5ABD1788617A21FEB71340513205BDB17EC4E693F63BE16BBE311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download