7a45536610652ea87c8aed24295bafff2725d0ca1642b6d6a4b3622008f2d2b0

Analysis

user interaction
yes
max time kernel
72s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 1004KB
Sample260718-1w4n5agy21
SHA256 7a45536610652ea87c8aed24295bafff2725d0ca1642b6d6a4b3622008f2d2b0
MD5 049e25788bdd71375680d15aac9ac439
SHA1 7d13816ce356cf88fbc4fde58375bdb9a9d4d832
SHA512 48b677e778e7662ab47b7a963fa01fefb124a1a844cd20181cb589b1403175e724018fcd9fa10fc0854e4380a6459c4b2de79c28b23f717c7d231375fd860925
SSDEEP 24576:9Ib5qFnsmjOzM+B3FmUoY+5gjAkEgElLssKkQ190xhWZ/:k5i9mFmT5M1ErQkOCxQd
TLSH
T12B252344BAA6A472D56944358073CF82A33BFD76F9F94B476FC47A5F6C302019A23C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 4 IoCs

pid	Process
2000	irsetup.exe
2456	Time Stopper.exe
4732	Time Stopper.exe
4640	Time Stopper.exe

Loads dropped DLL 1 IoCs

pid	Process
4640	Time Stopper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000245b1-4.dat	upx
behavioral1/memory/2000-11-0x0000000000400000-0x0000000000581000-memory.dmp	upx
behavioral1/memory/2000-37-0x0000000000400000-0x0000000000581000-memory.dmp	upx
behavioral1/memory/2000-123-0x0000000000400000-0x0000000000581000-memory.dmp	upx
behavioral1/memory/2000-683-0x0000000000400000-0x0000000000581000-memory.dmp	upx
behavioral1/memory/2000-688-0x0000000000400000-0x0000000000581000-memory.dmp	upx

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Time Stopper\Time Stopper.exe	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Time Stopper.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Time Stopper\Uninstall\uniD646.tmp	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\uninstall.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Time Stopper\Uninstall\uninstall.xml	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Help.ico	irsetup.exe
File opened for modification	C:\Program Files (x86)\Time Stopper\Read me.txt	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Uninstall\uninstall.xml	irsetup.exe
File opened for modification	C:\Program Files (x86)\Time Stopper\Icon.ico	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Read me.txt	irsetup.exe
File opened for modification	C:\Program Files (x86)\Time Stopper\Uninstall\IRIMG1.JPG	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Uninstall\IRIMG3.JPG	irsetup.exe
File opened for modification	C:\Program Files (x86)\Time Stopper\Uninstall\uninstall.dat	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Uninstall\uniD646.tmp	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Uninstall\uninstall.dat	irsetup.exe
File opened for modification	C:\Program Files (x86)\Time Stopper\Recommended Software.url	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\True Love.ico	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Help.url	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Uninstall\IRIMG2.JPG	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Recommended Software.url	irsetup.exe
File opened for modification	C:\Program Files (x86)\Time Stopper\True Love.ico	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Icon.ico	irsetup.exe
File opened for modification	C:\Program Files (x86)\Time Stopper\Help.ico	irsetup.exe
File opened for modification	C:\Program Files (x86)\Time Stopper\Help.url	irsetup.exe
File created	C:\Program Files (x86)\Time Stopper\Uninstall\IRIMG1.JPG	irsetup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Time Stopper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Time Stopper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Time Stopper.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2384	msedge.exe
5104	msedge.exe
3940	msedge.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288856747408405"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 48 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{ABD008A8-907B-410E-8A76-8EA9E41333C1}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Time Stopper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1"	Time Stopper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Time Stopper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Time Stopper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 9800310000000000f25c26b0110050524f4752417e320000800009000400efbe874fdb49f25c26b02e000000c3040000000001000000000000000000560000000000b3b6c000500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Time Stopper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Time Stopper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Time Stopper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Time Stopper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 6200310000000000f25c26b0100054494d4553547e3100004a0009000400efbef25c26b0f25c26b02e000000bc450200000007000000000000000000000000000000452db700540069006d0065002000530074006f007000700065007200000018000000	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Time Stopper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{3B69E256-132C-4A1C-BDF2-6636F8372689}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Time Stopper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{1038E47C-BDE4-4F8D-A314-DF2E9F03A1E9}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Time Stopper.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Time Stopper.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Time Stopper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Time Stopper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
3628	msedge.exe
2456	Time Stopper.exe
3628	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2000	irsetup.exe
2000	irsetup.exe
2000	irsetup.exe
2456	Time Stopper.exe
2456	Time Stopper.exe
2456	Time Stopper.exe
2456	Time Stopper.exe
2456	Time Stopper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2000	4736	setup.exe	85
PID 2000 wrote to memory of 4916	2000	irsetup.exe	87
PID 4916 wrote to memory of 4180	4916	msedge.exe	88
PID 4180 wrote to memory of 2956	4180	msedge.exe	89
PID 4180 wrote to memory of 3940	4180	msedge.exe	91
PID 4180 wrote to memory of 3244	4180	msedge.exe	92
PID 4180 wrote to memory of 4236	4180	msedge.exe	93
PID 4180 wrote to memory of 3244	4180	msedge.exe	92
PID 4180 wrote to memory of 3244	4180	msedge.exe	92
PID 4180 wrote to memory of 4236	4180	msedge.exe	93
PID 4180 wrote to memory of 4484	4180	msedge.exe	94
PID 4180 wrote to memory of 4484	4180	msedge.exe	94
PID 4180 wrote to memory of 4484	4180	msedge.exe	94
PID 4180 wrote to memory of 2860	4180	msedge.exe	95
PID 4180 wrote to memory of 2860	4180	msedge.exe	95
PID 4180 wrote to memory of 2860	4180	msedge.exe	95
PID 4180 wrote to memory of 2220	4180	msedge.exe	96
PID 4180 wrote to memory of 2220	4180	msedge.exe	96
PID 4180 wrote to memory of 2220	4180	msedge.exe	96
PID 4180 wrote to memory of 1228	4180	msedge.exe	97
PID 4180 wrote to memory of 1228	4180	msedge.exe	97
PID 4180 wrote to memory of 1228	4180	msedge.exe	97
PID 4180 wrote to memory of 3704	4180	msedge.exe	98
PID 4180 wrote to memory of 3704	4180	msedge.exe	98
PID 4180 wrote to memory of 876	4180	msedge.exe	100
PID 4180 wrote to memory of 876	4180	msedge.exe	100
PID 4180 wrote to memory of 876	4180	msedge.exe	100
PID 4180 wrote to memory of 3348	4180	msedge.exe	101
PID 4180 wrote to memory of 3348	4180	msedge.exe	101
PID 4180 wrote to memory of 4856	4180	msedge.exe	105
PID 4180 wrote to memory of 3768	4180	msedge.exe	106
PID 4180 wrote to memory of 3972	4180	msedge.exe	107
PID 4180 wrote to memory of 3720	4180	msedge.exe	108
PID 4180 wrote to memory of 3100	4180	msedge.exe	109
PID 4180 wrote to memory of 3768	4180	msedge.exe	106
PID 4180 wrote to memory of 3768	4180	msedge.exe	106
PID 4180 wrote to memory of 3972	4180	msedge.exe	107
PID 4180 wrote to memory of 1456	4180	msedge.exe	110
PID 4180 wrote to memory of 3720	4180	msedge.exe	108
PID 4180 wrote to memory of 3100	4180	msedge.exe	109
PID 4180 wrote to memory of 1456	4180	msedge.exe	110
PID 4180 wrote to memory of 4876	4180	msedge.exe	113
PID 4180 wrote to memory of 624	4180	msedge.exe	114
PID 4180 wrote to memory of 4876	4180	msedge.exe	113
PID 4180 wrote to memory of 624	4180	msedge.exe	114
PID 4180 wrote to memory of 4540	4180	msedge.exe	115
PID 4180 wrote to memory of 4540	4180	msedge.exe	115
PID 2000 wrote to memory of 4628	2000	irsetup.exe	120
PID 4628 wrote to memory of 3628	4628	msedge.exe	121
PID 3628 wrote to memory of 4932	3628	msedge.exe	122
PID 3628 wrote to memory of 2384	3628	msedge.exe	123
PID 3628 wrote to memory of 1064	3628	msedge.exe	124
PID 3628 wrote to memory of 1064	3628	msedge.exe	124
PID 3628 wrote to memory of 1064	3628	msedge.exe	124
PID 3628 wrote to memory of 3248	3628	msedge.exe	125
PID 3628 wrote to memory of 3248	3628	msedge.exe	125
PID 3628 wrote to memory of 2380	3628	msedge.exe	127
PID 3628 wrote to memory of 2380	3628	msedge.exe	127
PID 3628 wrote to memory of 2380	3628	msedge.exe	127
PID 3628 wrote to memory of 1296	3628	msedge.exe	128
PID 3628 wrote to memory of 1296	3628	msedge.exe	128
PID 3628 wrote to memory of 1296	3628	msedge.exe	128
PID 3628 wrote to memory of 4812	3628	msedge.exe	129
PID 3628 wrote to memory of 4812	3628	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:675362 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\setup.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-1074038928-2032447174-945360078-1000"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://timestopper.blinkweb.com/help.html
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://timestopper.blinkweb.com/help.html
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x250,0x7ff91cc5c188,0x7ff91cc5c194,0x7ff91cc5c1a0
        5⤵
        
        PID:2956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,6557200786652394137,4072565914749188495,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6437558869055241386,2078885981159035251,262144 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
        5⤵
        
        PID:3244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,5395807976212868818,18139119880270649550,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
        5⤵
        
        PID:4236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3164,i,14363177129091187881,13586389309780243451,2097152 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
        5⤵
        
        PID:4484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3168,i,15534320118882044567,354620271721011656,2097152 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        
        PID:2860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,13293004499683041634,17691817618041681271,2097152 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
        5⤵
        
        PID:2220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,6766578372433227621,13628887541851098514,2097152 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
        5⤵
        
        PID:1228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,5740752946591922181,18119570721821111677,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:8
        5⤵
        
        PID:3704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5288,i,11320139329953690945,5733181298036311798,2097152 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
        5⤵
        
        PID:876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,5064906508018626605,11546298615250602913,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
        5⤵
        
        PID:3348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6020192227008993099,7910784614299172265,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
        5⤵
        
        PID:4120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6020192227008993099,7910784614299172265,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
        5⤵
        
        PID:4856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5560,i,16924515928497822412,14084698303846772755,2097152 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        5⤵
        
        PID:3768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,1318609068303810381,13771561709055199279,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
        5⤵
        
        PID:3972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,13541173643750797957,5839855982318258380,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
        5⤵
        
        PID:3720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,3786498989627656105,37414996733825686,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
        5⤵
        
        PID:3100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,1461233127766445638,3846111168024712265,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
        5⤵
        
        PID:1456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,3416124084127190174,17030370650167169279,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
        5⤵
        
        PID:4876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3924,i,3102084927715827982,576796568920498658,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
        5⤵
        
        PID:624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,12085595045569767661,624697316420230492,524288 --field-trial-handle=2556,i,13995332240866310779,3778419501287669027,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:8
        5⤵
        
        PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://timestopper.blinkweb.com/help2.html
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://timestopper.blinkweb.com/help2.html
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ff91cc5c188,0x7ff91cc5c194,0x7ff91cc5c1a0
        5⤵
        
        PID:4932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,12243383893137531838,1573009669470154503,524288 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:2384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,11230001766501537625,14746956491052597895,262144 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
        5⤵
        
        PID:1064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,7199093459591953739,16441760988345010695,524288 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
        5⤵
        
        PID:3248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,15707196767321321211,7855491411356568725,2097152 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:2380
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,18018329735819470423,12078302036148039359,2097152 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        5⤵
        
        PID:1296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4884,i,1212667017126632344,3107787160921795511,2097152 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
        5⤵
        
        PID:4812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3740,i,1635748966697320788,17164208047993733625,2097152 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
        5⤵
        
        PID:2220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,17176564602338214374,1229952874693021238,524288 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
        5⤵
        
        PID:204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,13561704576479520996,13850173874978564542,524288 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
        5⤵
        
        PID:4868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,2872008607066738739,1317487703178960283,524288 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
        5⤵
        
        PID:2924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,2872008607066738739,1317487703178960283,524288 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
        5⤵
        
        PID:4488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6036,i,8904754088916389686,13702728075035053072,2097152 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
        5⤵
        
        PID:5616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,12339794927708789461,15846220891111631076,524288 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
        5⤵
        
        PID:5344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,560928187122729602,12162907717987753490,524288 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
        5⤵
        
        PID:5352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,11317159709053629566,7329143627813691434,524288 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
        5⤵
        
        PID:5324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3984,i,5147156200997865841,7260730319429760437,2097152 --field-trial-handle=2324,i,16391354654295601054,933246069263726661,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
        5⤵
        
        PID:5264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:3304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff91cc5c188,0x7ff91cc5c194,0x7ff91cc5c1a0
        6⤵
        
        PID:632
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,2277726108596129359,17509506717699651673,524288 --field-trial-handle=2264,i,14848648064804815611,4657174871688574441,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:5104
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,12950516669427151023,6134797270032327213,262144 --field-trial-handle=2264,i,14848648064804815611,4657174871688574441,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
        6⤵
        
        PID:6140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,10177816138423456546,18296437023499824963,524288 --field-trial-handle=2264,i,14848648064804815611,4657174871688574441,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
        6⤵
        
        PID:1148
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,16284187443514774681,1942807695789955766,524288 --field-trial-handle=2264,i,14848648064804815611,4657174871688574441,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
        6⤵
        
        PID:3052
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,16284187443514774681,1942807695789955766,524288 --field-trial-handle=2264,i,14848648064804815611,4657174871688574441,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
        6⤵
        
        PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3232

C:\Program Files (x86)\Time Stopper\Time Stopper.exe
"C:\Program Files (x86)\Time Stopper\Time Stopper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5372

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3016

C:\Program Files (x86)\Time Stopper\Time Stopper.exe
"C:\Program Files (x86)\Time Stopper\Time Stopper.exe" 18\07\2026 00:00:00 "C:\Program Files (x86)\Time Stopper\Time Stopper.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4732
- C:\Program Files (x86)\Time Stopper\Time Stopper.exe
  "C:\Program Files (x86)\Time Stopper\Time Stopper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Help.url

Path C:\Program Files (x86)\Time Stopper\Help.url
Size 130B
SHA256 812be46d40817e66726fd8150af4fe914d8b4ba7322dc23cace1fcd0b93d5cda
MD5 a5d82c675d63056a284af48ee3203619
SHA1 38046d8cb9a7485e673d2ba78cc803f27831275c
SHA512 e7c36b395768e2f1241967a4fb5d5b676d691e44f0656555ea81a1ce3886b023a4c5a0c9af573f53c1575b7598155427998a3d2257ab7398e89eac1aaccba84c
TLSH
T17DC0929C820485AAD652898AA0F2F848D90E79E818C2D4DCF1A4DE8A0F19082C496F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Recommended Software.url

Path C:\Program Files (x86)\Time Stopper\Recommended Software.url
Size 146B
SHA256 7950b5dc4fbc48b0838265ed4f7113177421c70cbcac10c231b1e2a3473fda83
MD5 51d58dd0c86e06b70613f3d6dd1602a4
SHA1 da4c6b25ef2563166bad58e91878369d16bfc7b1
SHA512 91fed37111e5b517d93a30bd4a8a0219479a1ce53eed8b28bc5ffd6e3437d7d2c7c93b0f40e7fcdaa929e20e1c2b51d09223b843bed4877e91522ee78de1c735
TLSH
T1CBC02B4C5105C196C5024507E4F0F484D40F7AD804C1C0CCF0D0CFCA0F051C2C054B2A
MD5 SHA1 SHA512 TLSH

Submit Download

Time Stopper.exe

Path C:\Program Files (x86)\Time Stopper\Time Stopper.exe
Size 376KB
SHA256 81ca080ca985e7001c23c8fb85cb522b8b11f9599f80d66821a5069d02e6ff66
MD5 2e682d68521e0ff83d4d3c4f868d0d5a
SHA1 2d990b09bed2bfcd0fb3cf70f241676977688aac
SHA512 ce0068703d81d2d6fc97db5d14cce80c109e6e7eef1d6bd04c1aacb1b738f16a2a0feed2126f6b1a118bbc686840f097d9feff2697141b32db69f2a6a4434f15
SSDEEP 6144:qorqQ+s8ZBNBa38QuvbqFjWWQmqtPYYa/:3D8Bw8Qg+tAQ/
TLSH
T19784D7D2E410C294F42A44B1E43EDDF20A1B2E3AE952242F349DFD9779B305741E7A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.xml

Path C:\Program Files (x86)\Time Stopper\Uninstall\uninstall.xml
Size 3KB
SHA256 100414e9f8bdfb085f691667b910f7bb96bffb9a2817c67a73f3609c0143a815
MD5 9fc1bf7014470eaf1d324b79dab2aac1
SHA1 73f5c177298eff0ede3918586d406c4eb8a3e3b7
SHA512 43c0a24b57a0915ba4fc0cac9b44ff1b3befb33ee6435b07f93a8c0972cf5a44699df963d586699b07cce14e95e652d5c3a47f74a1cb94688191773601176a6c
TLSH
T1ED513A2CC89CDF17EED276B73681242C9913DBCC2A960C91D2C6C18754D3865B6F2AED
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.xml

Path C:\Program Files (x86)\Time Stopper\Uninstall\uninstall.xml
Size 3KB
SHA256 cad149129ac90d84417b7ac2cb70347abe1bb37981a28a6f8d6a18c4a27e9e57
MD5 c9dbd4891088180978476685a19dfd51
SHA1 28984a5cc58f0b3d2b3cfa159e8e8553133fe6f9
SHA512 d29aa5d56939ba30c300d17e0e57d417618b5f610b1281a7f9051a8b959dfc4d2167b727a4dfa4453b78449b818721d1989d9f495141e08008b203ca8efb18d4
TLSH
T1DE716F1CC49CEF17FD9276B73281282C9913DBCC2A960C51E2C6818754D3C65B5F2AEE
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.xml

Path C:\Program Files (x86)\Time Stopper\Uninstall\uninstall.xml
Size 2KB
SHA256 362eaf1baa6f9fa7d6b3b95e8d161ae398aac871cafe666086d75c2ea5f9f58a
MD5 21e70f3fcd485f006c6e1b7d5e387e04
SHA1 58ca7dcaee414276dc358069c14393a78db5114a
SHA512 d8e7da639864927086521b7fb79e6b72b6e086edb783296fb4ed5177d6b01c283c678fbebb54b9f419ac8f93710c4f69971ae531b2416b8604012f5df03b4244
TLSH
T18351072CD89CDF1BAED676BB3580342C9813D7CC2A561891D2C6C18754D3821BAF2FE9
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5ef87265fb315ae353f8956fe1637a70ca75d0378e75d68dbf9b58fa31835c95
MD5 912bdf113fdea1155b0bb71c70fc62ce
SHA1 052925f70ca969f313ab3aaeed0df4da91409ba6
SHA512 5c32f1fa9e8a135369e8504b0a4a8e5eaf2a496ca55168f52d194647cc5d05ca5cd548a96e485542904dd958fd50a5f59b2b35eaebc4f4e67f470b7b723ae89a
TLSH
T1B8D023317B65AAD1D135357AA4304741BF250176239DC1176154840CDC7D4C65BC97C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 caa101a4aa049b7a69908c8d16c18b855d1193abfca8ffc031edc9865218e49e
MD5 35e3568df3c347632e755acf2f969e14
SHA1 f88551e1b29834fbb3aa5658a7ea188631076235
SHA512 491ed2ab0b66d60083b5b2b0c32a177a3f8ba248fe7f0c08277da0e51f130e45b070a9a7a2f14303299f69fb1cce982dea04f0de427ae8fe3c24b3549f889e87
TLSH
T15FD02271B7A8AD82C7273572B420C382BFA253A8264DC43350B4801CEC798C64B8E287
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4e6f65ee70fd8ed53f1bf4c85444e83d90d7ed4d13586f0ba53454ac96da55df
MD5 b9abef4edf7ca6de48d70a4380ee26e2
SHA1 719075650281a940ecb8cd026247bf0db7dc48ce
SHA512 c2ca954e81ba6f29c7e229d938b5b52646f25b9f93f054b5afb204740b6ad8c3d4bf75374864398f17616bf81f78b0b6419018ac5d637cca7b81961320860818
TLSH
T1CED0237177A49D41C7173571B420C3427F5253A8264DC4335074401CDC794C54BCD187
MD5 SHA1 SHA512 TLSH

Submit Download

1302cab7-f063-443d-9fb5-39dd42fe34fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1302cab7-f063-443d-9fb5-39dd42fe34fe.tmp
Size 414B
SHA256 a42b8a2a411d8e9b415a4aae8a5fc3f9788331133975e55985eec0449c80bb74
MD5 c251a0ba5edb4287c8e41ab5e2a174f6
SHA1 c427a65d365ea39f226df2f255e0af7bdeae7de3
SHA512 402fabb66c93738c9cad8db29e5616fa7af60535f37567d5bc3edcf7834b2efc2ebfccea840a1dc58d6215fa0c2a2569ab943cd9024ec1882254f6baa9cb6463
TLSH
T1D6E0E5AEC866DC2728FD476D51580782EA50239B2780495B3B3C820C8FB16260A5285C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 feef001aef9a6e5da0d0b9a53734726f40bf764b7c74aa9f94d466f608af7982
MD5 bd4de0376703e10368fa43737f311551
SHA1 fcf7f0e43c7444218d09b30502a2d8cacb5bc6eb
SHA512 a91747748f12e4c37a189823b67e38fc8ef6167e2624de9c0a8a45f54d50101f261d2fead9f91792daeb8c6e4656608b2ef1e7edca56ccb961115e0de7490f5d
TLSH
T133714C4211567C77EBDA0AF1F4CD4209B8F1CEA50E531FD5159CB8BD9827B63809AA0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eeb0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eeb0.TMP
Size 3KB
SHA256 cbb24687410c73f6322d3c5c57a9bdb5aea43d5f77614793ad50fd5b6e21d06b
MD5 5cc2753df04d28f46be85e4b8ab2e00f
SHA1 7f42ff1d5ebf47bae1e296b836efd24e59f3e8b7
SHA512 df54150591885df2716f46c321b0644311634bb433be4d3fb704969b2e4b8b462f6ee1305a0a3fd299180756197dd5da847d2591f80198d5310dc8763fbf72ff
TLSH
T189713B4612967C77EBDA0AF1F4CD4209B8F1CEA50E531FD6155CB8BD9827B23809A60B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 570B
SHA256 99def1b557f19f04c1affc6f247d0451f33fc10ec42e73792223c3215ac98be6
MD5 d4ba0ae0bb0b9faff3da6f35fdbc3c8a
SHA1 fb3e9dec7f35a9b1d94e54a5659dd0de484055e7
SHA512 86fd07c34b9abd4c52ba19eae291936f92bc6d38a75c021edc1dedbc15617669876180cd99f959c62476d82ec6bb9f5fe4c6cb4d82cb037efb76d99a4d3d9c51
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 316B
SHA256 b58dc1d18b1d07031d03e65f2045bf60dac4e27e0fdc69e27f433f640ba9a7fc
MD5 7559b05b6ddbdd979218730168909999
SHA1 b2a34693e882e5717b985943988f25459e232aa0
SHA512 6464671d3d17a203ea51897b6136ac79cdefa3d1cd18a61f36f317b99ae65f2f9d6861525bd819033325732c889e87df22bf354f59d5c040fb0b047196684ba3
TLSH
T1E6E0260814CBC269A0546897877CB74DD3E2389AF28F3A0217489880B141381B3BF3D0
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

computed_hashes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
Size 429B
SHA256 b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9
MD5 5d1d9020ccefd76ca661902e0c229087
SHA1 dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6
SHA512 5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c
TLSH
T10AE055170A1A50B79BB8DB90EE525CA2E8A0A6B1C50438D63E608234B68A11F738347D
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 b67180d4332e979e090dcac310afcc38923a0e422cec80913c22a549acca0a73
MD5 c02a3df618b604b2dcc94b5259af2886
SHA1 7b6b5380143a7c19cc45f403875ddd9be99c8c26
SHA512 e85b94433d20c0057dece0b2235d47cd195977a3b768a947df0a2fbfffa91fb9d6bd2d40a79215b30c060f8fd574d3d40837ed7458aec5090d6429b67e6974f5
TLSH
T185E0D86465DEC229614439474338FB8DD3F1384BEA8E3B011B04AC41B085504B3B52D5
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 931b238f24c732a56ec10eaa2d39773c2acb4c1b3a792fa7b52395a32593dc2b
MD5 50b6b2e28b2d3b9ae802527250229a17
SHA1 27190b1eb328e346ca20683fed42635aa9d9359b
SHA512 517898163e20ca48e67732dd77d4c2091e3a0fab16b003dad0dd3085da52382c501a59c98409c27078ccbc9752585c04d444c78092d79a2b1a8bed77af35e74d
TLSH
T192319DF7C3E4856D8D0156F4AB186E1BCE2D0A15832C3C5AC9E4EF1B97E2471E24155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 65241c00b1b1a586194d6c33a4b80e8207dddfad2e90b2e059c42acc8198f19e
MD5 60396c9fdd01c275c5057ed66b31a552
SHA1 d5ccd33c488a7892b2ec6dd4eaceafca6c472391
SHA512 96ce4b7088c2702ff046e48b3c5fad7a9cc65e937216ac5507921f97dab55083787ef8945204a9f325af48f717c37e72695ab264b4c3444fc1fb208210643854
TLSH
T11F418DF7C3E4856EC90156F0AA28BE1BCE1D0A15831C3C5AC9E4EF1B97E2471E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 284e439489934b7b92554c625119b4ed9cbcd43148101396830c0bfa4c5f8c1d
MD5 da067b1863437a25d9878ed7b797e252
SHA1 7f465ff4ba458e5fe9bfcae122f4ff18341e4a7c
SHA512 805cdcb7ca782b918965ca6a9afd2eb53272c0114eeb7e5c598097f86127fcb16b0e5096e59a925094b003681bd3ad75673481f6003658d35b07c6406cc4b671
SSDEEP 192:sxZ3RviyM/jK1Ml8/jy/fdsSWpVc2J3uHTjIdpREHVP6+WNGYQ2KNsIgyJ:sxZ3gmy/fdsSWvc2J3RuHOGMO
TLSH
T17352D815AA245D77CCDBD309FA557F93DAF91466E2900E44AAFCCA0C01E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8442fff95a82fde7f140a057ef7559551116738ca05cfebdbf41c424078a65ed
MD5 6ead88438dc23c1828dc24edd43f2a61
SHA1 67e9325f301e6c0c7213841f9e511844dd997f92
SHA512 4808be0da869653a3d74781b87812d28f0cad9499641e28bf8fe27123ce19c6dc1af88611307310933884a36aa9a18dccceafe7ed33ebc1bf56ed4c65afa329c
SSDEEP 192:sxZ3RviyM/jK1hl8zjy/fdsUuWpVSJJmHTqPzodpRVHV76+WNGYQ0j5rsIgbp+J:sxZ3dqy/fdsUuWvSJJRE3HCGccFK
TLSH
T16B62E756AA245D77CCDBD309FA557F93DAF8146692900D44AAFCCA0C01E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 879668f1b3c56ebc31812b2e4eb800468d0c66c64ccc10aeebcb1ad10fb9863c
MD5 b4e6d41b4f8b84537d43321f4bba3be0
SHA1 e48168b938b565f4fc0bbfe55610418007ffe23e
SHA512 6ceeaf218dfff8784c01575a0900e2ee79ebb99d7cc0858675708ea82ae1369554845d322d41cae9a2cf10d3da1b72bc9bfbf8f20ce6af4f3772e09eb54eb2e4
SSDEEP 192:sxZ3RviyM/jK1hl8/jy/fds5uWpVSJ5uHTqPzodpRVHV/6+WNGYQhnxeIgyJ:sxZ3dmy/fds5uWvSJ55E3HGGAO
TLSH
T16C62D616AA245D77CCD7D309FA557F93DAF81466A2900D449AFCCA0C01E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 6acfa075a39ddc5530bb3d40059db93feab89fbce9fe1048f6bf52deeb173dd4
MD5 a6924ee80292f4293df0fd4e3c06a116
SHA1 4c9fb8d4a98a7958e6991e15cfe552fdca7759df
SHA512 8a9a3f941cf3538bfecda4118696cd1b91001e68e09482720672912526f6fa381798a86afd8cc4a87ceeb8977cdca7dccf6c6f2c5b5d78cb769930778d43e75c
SSDEEP 768:wy8iJfZ7pLuLfxNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVd0hALl6opdfroL:wy8iJfvEfxNWvx76ru1jaA0hALocdM5t
TLSH
T18AF2FB3B6C0CCB7E4F804E9CEC2A6E9A6DE8018F5A98895447FA841C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ac4fb3f339bbe2194205b25472cd0ea2caed93b72ebdbbf6f5c9b176f49f2ea0
MD5 c2b6bc911a3a49e39cadbbbf18014e7a
SHA1 de63ca3f148f80369886c341f7651ff804cc8f56
SHA512 047b24be2da1eeced33f777ca55713d630851b933079704e7f1fb653545d0646d0f666a76224e0f7ba9886a5fb5828cd9bd2e6a8ee2297308264678b0013d43e
SSDEEP 768:wmoiJfZ7pLuLffNWvx7ur8F1+UoAYDCx9Tuqh0VfUC9xbog/OVd0vALl6opnfror:wmoiJfvEffNWvx7uru1jaA0vALocnMHL
TLSH
T1CAF21C3B6C0CCB7E4F804E9CEC2A6E9A6DE802CF9AD8C95447F9441C02C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 1a7955ff7ed3e86b4d4984714655b6c3e5a18867d6995d5585e3b30233cdd23a
MD5 cc158646002c4ac58f08b05c15ae74aa
SHA1 3d6bb17e489a0d950b257ec3ef15512b3f9c3dc4
SHA512 940be051c11c2b3acdcfaf5d4708cd12207bf70d33a36c0cef0e4adf04db69a81313bff54e3fcbf8a97cf72ffba42a0dfe9dae1cfc944bf2611fc5a4eec25927
TLSH
T129E0D81825CAC7B971962153013CF78D93E5792BE2CC3A011F449C40A2DA508727E250
MD5 SHA1 SHA512 TLSH

Submit Download

Tabs_13428885676991027

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13428885676991027
Size 1024B
SHA256 9884312cf9a6257e858e5387d5807305f7a3f49451390c4fde591e0151d3d1ad
MD5 3979d3096afc617897aa2a6b6e1e1f41
SHA1 8b1b1b81ee7fc387cf6a0ea7fee912ee6a1d0f24
SHA512 bd94402bd3ba3bc40a1330937ca074e1fae6e5de8c8d8d5d6e3354c474828880cabe2a9cd14cd6c82fe4891eb79981360634738f5d0d6860cc89689df272014d
TLSH
T181117D4CA2DA192AC43C8779F5FB11E5F736BA547380CF1F82A161180A627066E31F94
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 ed7baefabb849af55c07d28237475f5d27a85e262691004a77a8741c6f216565
MD5 8f8fded2951c085de721a945ce3fc5c4
SHA1 069285a2fa4e9853ad3eb70a73e537d6e18078fc
SHA512 6cfe86ac4a38666f30dde1c49c52c26220007d6621f9467373e58f7510a5d5ba0fec2ae458140fa43abad0dcd38e163cfc35219c4c621e6dcceef8d781424b38
TLSH
T123B09208BB05E923C889087145844F809340E102A0408C0288244B304806AAC2F128E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 71f50485e9fa59dcf29d0d822c93ccae2f7b29d8d8a8a7734e9ca65103696ecb
MD5 e45a1ac42dabc236b4e49991b5782a10
SHA1 ed3dfb407d84676e77dca32404a4d66b38f93d52
SHA512 f849cf85fe0146206de4c4eb93c1ad502a8333aecdbba67604ac6fb3fc8384de9a70771bea29be2a0016b1138dbbb83c0a2737fac4215de3d6dff4764df9f788
TLSH
T1C1E0D86466CACB2E71C7209B4228FB4D92F37816E6CD2A116F08A440B296244B76F650
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 35db44251ef08df9be567777cfe6f0695f22237d0456acc0bf7f95e7be232cee
MD5 6b00fa35f4963ff5c0dd0bd9001e7aa7
SHA1 fe8368922966bf2922acb07496e6b51ece7e63d9
SHA512 a5d5c36816224ef9e54a95ed23f6a425391caf550cb52be93e170f166f41e5a66c9c07259eccd499cc416b31211d716d11ee15749efcefa0fc290e199d86bb88
TLSH
T15CE026B495CECB3D608260974278EF4E93F17C1AA3CD3B0297085840F2C1208F3BEA90
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6b705e9315ed3b222b2982e03a908644fdd534bff84022c0b571925631beb375
MD5 e03dfc8261f72f875b65f1555b61fdaf
SHA1 39ae8f9e2ffc861fab8b75943d2408a38a9133fd
SHA512 7fcca486cd4514261c62e9370b2da81dfc28114aacca18e88f99fae173396e585bcb5a3cf5992c55f635927bbca582fe8e331d181c480108a60dc9cfad564093
SSDEEP 96:KgvmbPVdd+PtklFv+K9LFR+p3v8B/fs4AKdGiliKWMi+p+KC0y:DvmbPVddItkfvvLFRU3v8B/fpsVZr
TLSH
T128A14F11327B0642297E2618D259DB1BEBD270673008E52F3BB911724FA7E222DFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

load_statistics.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Size 120KB
SHA256 40594cc6616625d72a320b4d6508ea6f4992ef4397d77c67365767d27d4c666a
MD5 e0f4fc3ff702dc7788af4ae353ac6d16
SHA1 1071a08bb5446a552de830ff9290d353dc2e9b21
SHA512 48e95c7572f7887c2abf5138992ebeaa0557b93b2a4bf9c56d73fddeb386f79881cb5ada6633cdc63f02570784045715336ccd3bdfa461394b01083831669e46
SSDEEP 768:5cA1FfqSVHJJ7QXbb1c0IiUsF3g5PhSuRuxVc+NX+eu80i/xLZCTp3Z75AasB4ar:AuJAJ/FWpXJwUn+8QArpkkWX
TLSH
T1D7C3FEF76C0991AAC9CD91B8D51BEE44807317218630D9E5AF3C08C37B79A0BBE795C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 12KB
SHA256 94c298b5c5d4f6258509508821ef963caece8ae027c5735ab22ab199c0ab1bf1
MD5 31315aa27304e5159fd8458ca19d6a75
SHA1 51ed9f4fffe19e382ed940fbb40e93ac7d322c9a
SHA512 9f590db3fc17cc2710b5b2b9756f857f1fa1b1f7555c8c1180792e7ab37a37b7064ad120589de2e344c7d2a7f77b0236a24e69c3ecc72ea975ff3b7c2abee55a
SSDEEP 192:EQfrIIICbyMIM8HNYcYVr3OwqAswkl9HBus482:EQfrIIICbyMIMUNB5wDshWs9
TLSH
T13642832A52055B37C09F5F7A23538DC45AD89C8140B2612C71563D0FAEF3F8782E62FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 f05fce01807aac08072ce16136f6dff981da568c9cb922efd97294406b50f6da
MD5 42c72199c52f1068072d97956916f007
SHA1 4ef07aaf2e69e66882f581150cb2fe030971a860
SHA512 a411ad6f2b2d45aa9f8b3dff9106ea26f286b4b47c334257ae2f35e274b80ea4f5a022edbfb21f5e1b4371bd111aad18cdfe14f0e6e2ed418de641d36f0a6717
TLSH
T146E0D81464C5C3AE705520870228BF4D92D1391BFA9B2A852B0094447441641B36D253
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 ce629924007e9b670437460241805fe4059d447100cb6d9c3aeef2f5b1ead6d8
MD5 6108ff0d64593c217bcc41a865bc06b2
SHA1 1eab4d89d8fa4415dee2d34b11a8b73143a7262f
SHA512 b5cb18b396bdd8d3e77af4b44b0d8dbd14fc93886acd48c5cbd1fadb7656c58184797eb1bcf5f32da2014c0238eb5805b9f14bdc2924f550e227ad436221a525
TLSH
T1D0214C52F330C049D545563A583E6B1A1334D8528FF8EC0F94B924742E72F480E476E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 334B
SHA256 efd92d03598690214c61fcf7ec96ba384f8195ca134bce75251327a8a9297ec0
MD5 c48338531d27654cf59a2b3dd4f8020d
SHA1 b910eef198329f60555fe9c0a18a8d5c9098a6e2
SHA512 38a317f67ff4e3378e0e05a8c606c10c5348b72d598850e1a22f93e88c88309c40520680494a06896c8abdd204a8af3d62ad2cc7cbe1582e898ab22e28ce3306
TLSH
T113E0D81474C5C29F60952083017CF78EA3E23C06FE992F021F008844B1022C5776B291
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 af869d675a8c9f118a9019bfceef97e991b4235297ba7ac5cc0b2a84f1a69a7d
MD5 475217772781811034eced18ab6df3be
SHA1 93059771df0468ef62a0d351d2d466db0f402bd5
SHA512 e24ad0a34a7d49aa2ea80d79e7b35ef20ea464ede69011a7d94d294830edc1e038cc63f7f0082b7c789a6f89bfeea89c36af9896cb4c79c81503e4eb474aedf3
SSDEEP 96:wqONklQsjpfmUT6K5ih/cIPURHl8h4otop5TwDfBAPwivh50xy0SFYK+AxADERxN:7ONN6kLQmiUyqpS903M6NkZcRuq+U6
TLSH
T184120B3268B86C6B6DE3A955F48736175EA5822BEBC97F90E5DC1A0C04EF35C130B522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 33cbed11b22d9db889c3f18e40301f86fb8c7746594dcf19e279165b0aeb60a9
MD5 2db37b6c2506b143dfea3acd72c1c401
SHA1 90361d6d4b7d3a61a56303223c85022885dfcfe1
SHA512 7445c8ffad05f04ec3d456c7519d55d46772e22f34a6b9a7f708ec193dd72d5ccf24f696625011d9100125e71c8c4130362ca887ef47aa7e6e5bdf7e20f658fb
SSDEEP 384:netNn/s3n9SZ3sNXrBcQGkBgkHScA84/o1f9iRQkXzOObjI9G6w7vU4HA/7IzA:ej+9k30ZY8N1f9iRVz29Mu
TLSH
T197C26A71E8A45DE74892D5C8A646EA177EF5423BC38C1A5CE2F8BA3D30DF5BC8312461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7606cda75d746582f0d1cce27a4ea0a3d7dc2a5afc23ac48f300e74576d38623
MD5 aeb247ce261897a6b2c75dad0e94de5b
SHA1 e1a84e8e859e3aa6dac222e33f842ad92be2c5f7
SHA512 b8bd7470177d91af60184864c3584fcb6dd63f2a9ab636555c1024d4a809d66c11c65869381d74db6a2a5ff09c922c602c73e27eeac418b579ed750bd7e91af2
SSDEEP 384:njtNn/s3n9SYsNMvB7QGkBgkVORA8tQM1o0sqN437aOObjI9G6w7vUE:jj+976TR8IzqN437a29M1
TLSH
T17FC26B71D8A96DFB4492D5C97182F6276DB0117BC68C0E4CE6F8BB3C309FAB81716820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2196df2d8182b888ed90d3f930b0d07f1a5a65044084b1120632ee16012cba3d
MD5 0e6f88222ce0309b446f5320e7f6efb9
SHA1 17fb5d3a89a4d7c9361490db66bafa9ba523dee4
SHA512 5fe9baa758782804452638809c1946cb54b6c718c616ab70633a41b354154b7bf2c1ae88ede1b5b8b82fd6ad1eef47edd6fe1b04b9f2f091eba5b31f3f3e6556
SSDEEP 96:ZqONkWQsjpfmUTmDK5ih/cIPURHl8h4otop5T5DfBhPwivh50xy0SFYK+AxADqQ0:gONS6kDfQmiUyFpZ903SQiBFjU6
TLSH
T1F902F93568782CAB9EE3AE05F48737276FE5112FEAC52F94D5E81A0C40D734C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 90e4c31cf33dca1100d7f908cbad9412afc2b96c1d9e48a78b1529d43bc2d89f
MD5 832fda13d4beb9f41126a9aba3623f2e
SHA1 6c62475d154e23921cbb65e8181a9af360cf194f
SHA512 a413f89ef46a20fcc90005b11e1bdf1aed18dc3124d97040e44f761bd98e82fd666ef4067bbd92d97e55240e09ee205c3b873581cd42ffdbad449ed4e50302e8
SSDEEP 384:njtNn/s3n9SYsNMvB7NGkBgkVORA8tQM1o0sqN437aOObjI9G6w7vUE:jj+97TTR8IzqN437a29M1
TLSH
T144C26B71D8A96DFB4492D5C97182F6276DB0117BC68D0E4CE6F8BB38309FAB81716820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9fed0fc52e8e762c4462a3e98dc531b3612a94f47702265ed45ca91a6333ca02
MD5 7a0c68e534516b9203f2c915649ccd88
SHA1 340c78950690a63964df3a7d5d107bf6044244c0
SHA512 4637eea9f8ec6a726391f4ca99e19b0d947993d7be636eeac67e49584c686b3b0ef2edacb43be2f768aa626ae0e7205fa33644ee0f168e37c63d178ecc4f3988
SSDEEP 384:nutNn/s3n9S5sNyCBm1GkBgkHeOObjI9G6w7vU4HA/7IzA:uj+9eRZe29Mu
TLSH
T1FEA29D3568699D775D939619B28A3B6BBFF401BBC7C52F94E1E88B0D00C63AC170B412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

f34a1efa-7ce2-4463-a28a-8e54a80401e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f34a1efa-7ce2-4463-a28a-8e54a80401e6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ff9ed1d0e47e7b4bb5922716d6cf35dfb8539655ae46a756d5325dda33cafa4
MD5 1f47c5e75e68f798e5103d6eae4cdca8
SHA1 621c298641972269bbcc650697eb763da09f75f4
SHA512 5d28b105bae07c8cea3bb6af6894689702f2ce353afcfa385a1dd5db2ed88522daa59b7c0af99116c7cf9944a1ffe7f181eccc4f206f7397d08426d827da1f9e
TLSH
T165410958AAE91118B3B77E2AAFF2A86D487B78772F07D49D10010E4F4637A40C862737
MD5 SHA1 SHA512 TLSH

Submit Download

06b0f937-1186-4b39-b0fe-ec713d29a55d.tmp

Path C:\Users\Admin\AppData\Local\Temp\06b0f937-1186-4b39-b0fe-ec713d29a55d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.JPG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG
Size 67KB
SHA256 31b1b77ec3cc256f5e350727c87f22bc02430c626bb8c565be7f1f240f35123f
MD5 710f56fb5f147bdc9ff66a36d32a8650
SHA1 b72db76b0a7085dd262d445794c8a291934081d1
SHA512 0307b5270925ec5d529f9b07902ebac583e4386703c4e417de196c01d2db8cd0e19b3890853b4a45dcb4023dee80387235abbdfb7d809c53a2f30cb8617cd480
SSDEEP 1536:kvnk3GZKJfy2VskcwrOpPZeRhjGSbuDN7MvXjmFco:P3GZKNy2GrU+ZmhaUm6XyFco
TLSH
T1ED63F1721C5AC0E19B8C007E6C2CB51B5BB299C9A499D40526E9287BF3D2F8B5750EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG2.JPG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG
Size 57KB
SHA256 2bc27873ff000d8c9e2e8a5f7271a1bb869a3439acafcc64e2fdc5feba8d7018
MD5 e2f6c74319dd44e9c836ee47161c1a7d
SHA1 6822a713797422692a9c4bdbfb548251effc091a
SHA512 b21efb54c7e260d22ef5063ca413454836b769e7d32ef8bff6f6a68494cecbd15fa140177c77a9e8030b123fe61d395b0ebb8e37bfa47d7a964e8b3e71edc8bd
SSDEEP 1536:lnpI0PBfBLRGqlNklqkXO/Ien6rjv97777CZ96peCwQUBimim/:Z9ZVsqls5NenAMLptVV/
TLSH
T17B43E17E7E14997099BED5A0B593353E15610FF9A728638935FE3C20324BCAB93A143C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG3.JPG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.JPG
Size 42KB
SHA256 dd1361385a49a263681b4a4b181aaa821cbb1ae8eb9533f9516a0d7b7b5be805
MD5 5bc38391c87994cb52f5b3d7fba1f158
SHA1 f0a39fe814bd15f36eff5971662ba3ef3921477f
SHA512 f7bbb1978b14c774077089f5f409ef7d953df2a8a09fcd9b3a9dcadbcf516cf14c572adb0741edd6365d71b356c426c59d2e1b337976fd480a19f7c7fe3e3a30
SSDEEP 768:aQaa7YhJcA8L+faDuJ+56gIyTOUrrjLtvWag6Yp3s3:h3MHMDu4OUrjteaghpc
TLSH
T13913AF091F434D12F0A27F710B941FED190D9EA6EACBFA2C21D14D69FA6106FE42B54B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 567KB
SHA256 6ecc1e00a4bd2f7ea071e008d47e9307e18cd82c0e89a46721e2b0e0a33dacf5
MD5 02dd75c96edefb8e88026ad9360a0095
SHA1 dca5e9833d019accae6d4ab5add4334eb953a116
SHA512 e460beaf0567831bda22be78b48f615165af30d6c34e795cafd0494ae4008389dce06c89c40e7e9127eb077982d04a8a925e336c8ee829c498070e2fcb45537b
SSDEEP 12288:qb5qFn7wVl3WAMOcqM+B3FGTPDgo+f+5gjAk0uobJXng:qb5qFnsmjOzM+B3FmUoY+5gjAkEg
TLSH
T194C42344FFA5D998E6BC483990B38F529337BC38EDBA1F1B62C57E1F9834E01611149A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6555622-f6c6-40d0-a962-faed152e7303.tmp

Path C:\Users\Admin\AppData\Local\Temp\e6555622-f6c6-40d0-a962-faed152e7303.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4180_1619192731\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22051126-1d60-4687-952e-6badf51de51f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4180_1873501474\22051126-1d60-4687-952e-6badf51de51f.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Recommended Software.lnk

Path C:\Users\Admin\Desktop\Recommended Software.lnk
Size 2KB
SHA256 099627ae5e651cc175cf3009899212c3361c48cadff5b2bb98cb75f30fb2f040
MD5 ec067d3bd7a54db86ef5aafe40d115dd
SHA1 aac20bb1c9ca0b0e3c9cc1a99379f10d88c30574
SHA512 04f7b659002286477de9570adcd5d693c17bf3934596bceeacd984b7ddce58835abeab3794bb6af8fb421af2bdd7d155ea97c742163a0c675faca67ca618c87d
TLSH
T19C41CE007BF91309F2A2F63259B72512FA77BD42E6A88E2E4181524D18B3A11529CF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Time Stopper.lnk

Path C:\Users\Admin\Desktop\Time Stopper.lnk
Size 1KB
SHA256 b7af9bb3d7688ae0be893fd2e5ef54d7f852d5bdbe848ff6972657c1c67bb8ed
MD5 e5aaf477d26da844149ef3de2a3a2316
SHA1 7a8a71a0a7a45f77aa3486503e835d98ba39a285
SHA512 455361b42a7283681c7971ef42aec3927209fdf82966a1f6719f98aa845c638398e1c9a5a6ec2ffcb641615d2c4f339c4e70ff0280e28adb766493dbb61e4db7
TLSH
T1D4416B003BFA171DF1E1E63291B72A12F677BD41D6A98B2E41C7224C08B35115698F6F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2000-123-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2000-37-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2000-683-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2000-688-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/2000-12-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/2000-11-0x0000000000400000-0x0000000000581000-memory.dmp

Download

memory/4640-1041-0x0000000000020000-0x0000000000021000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads