3185941045b3aee27d32a76c29454b9cc7ecbc4d0323dba31c5c31e30934b55e

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Drop.Desktop.Client_0.4.0_x64-setup.exe
Size 13.8MB
Sample260728-x4rsratfle
SHA256 3185941045b3aee27d32a76c29454b9cc7ecbc4d0323dba31c5c31e30934b55e
MD5 b6efa667a42eea28ab020bfd6e909ccb
SHA1 167f50158944775e6fd04659be46b8240dfdc58c
SHA512 381d2e03de7e1d77c132f261008685ca040d80240bbd8177e41715fff994c3196ffb85830d18a591a3e60990688cebd9bf5fc8c98c116bc99af96168f2d2db33
SSDEEP 393216:vJsBbORQMCsKo0xY/mhay77+52gpPzGbCrkv5P:vut8QMCZxY/mhay77+/pLGerUP
TLSH
T177E633F135746467FB11DB377B67C3B580CB82B53767DA8884AAB03C714CAA680D1A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6680	drop-app.exe

Loads dropped DLL 7 IoCs

pid	Process
4896	Drop.Desktop.Client_0.4.0_x64-setup.exe
4896	Drop.Desktop.Client_0.4.0_x64-setup.exe
4896	Drop.Desktop.Client_0.4.0_x64-setup.exe
4896	Drop.Desktop.Client_0.4.0_x64-setup.exe
4896	Drop.Desktop.Client_0.4.0_x64-setup.exe
4896	Drop.Desktop.Client_0.4.0_x64-setup.exe
4896	Drop.Desktop.Client_0.4.0_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	drop-app.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
72	camo.githubusercontent.com
73	camo.githubusercontent.com
74	camo.githubusercontent.com
55	camo.githubusercontent.com
56	camo.githubusercontent.com
70	camo.githubusercontent.com
71	camo.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Drop Desktop Client\uninstall.exe	Drop.Desktop.Client_0.4.0_x64-setup.exe
File created	C:\Program Files\Drop Desktop Client\drop-app.exe	Drop.Desktop.Client_0.4.0_x64-setup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_279142401\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_643489561\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1517751714\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_643489561\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_978745741\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_643489561\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_643489561\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_603391727\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_279142401\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_949230184\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_978745741\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_643489561\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_643489561\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6724_643489561\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1517751714\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2940_1667526991\_locales\tr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Drop.Desktop.Client_0.4.0_x64-setup.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6624	msedge.exe
3540	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297404209549436"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\drop\DefaultIcon	Drop.Desktop.Client_0.4.0_x64-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\drop\shell\open\command	Drop.Desktop.Client_0.4.0_x64-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\drop\shell\open\command\ = "\"C:\\Program Files\\Drop Desktop Client\\drop-app.exe\" \"%1\""	Drop.Desktop.Client_0.4.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\drop\ = "URL:org.droposs.client protocol"	drop-app.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\drop\URL Protocol	drop-app.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\drop	Drop.Desktop.Client_0.4.0_x64-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\drop\shell\open	Drop.Desktop.Client_0.4.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\drop	drop-app.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\drop\DefaultIcon	drop-app.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\drop\DefaultIcon\ = "C:\\Program Files\\Drop Desktop Client\\drop-app.exe,0"	drop-app.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\drop\shell\open\command	drop-app.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\drop\URL Protocol	Drop.Desktop.Client_0.4.0_x64-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\drop\ = "URL:org.droposs.client protocol"	Drop.Desktop.Client_0.4.0_x64-setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\drop\DefaultIcon\ = "\"C:\\Program Files\\Drop Desktop Client\\drop-app.exe\",0"	Drop.Desktop.Client_0.4.0_x64-setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\drop\shell\open\command	Drop.Desktop.Client_0.4.0_x64-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\drop\shell	Drop.Desktop.Client_0.4.0_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\drop\shell\open\command\ = "\"C:\\Program Files\\Drop Desktop Client\\drop-app.exe\" \"%1\""	drop-app.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{1668874B-06AB-4ACF-A52D-A9F8183EFFC4}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\drop	Drop.Desktop.Client_0.4.0_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\drop\shell	drop-app.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\drop\shell\open	drop-app.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4896	Drop.Desktop.Client_0.4.0_x64-setup.exe
4896	Drop.Desktop.Client_0.4.0_x64-setup.exe
2940	msedge.exe
2940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6724	msedgewebview2.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
6680	drop-app.exe
6680	drop-app.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6680	drop-app.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 6680 wrote to memory of 6724	6680	drop-app.exe	94
PID 6724 wrote to memory of 6444	6724	msedgewebview2.exe	95
PID 6724 wrote to memory of 5932	6724	msedgewebview2.exe	96
PID 6724 wrote to memory of 5932	6724	msedgewebview2.exe	96
PID 6724 wrote to memory of 5932	6724	msedgewebview2.exe	96
PID 6724 wrote to memory of 5932	6724	msedgewebview2.exe	96
PID 6724 wrote to memory of 1056	6724	msedgewebview2.exe	97
PID 6724 wrote to memory of 3600	6724	msedgewebview2.exe	98
PID 6724 wrote to memory of 3600	6724	msedgewebview2.exe	98
PID 6724 wrote to memory of 3600	6724	msedgewebview2.exe	98
PID 6724 wrote to memory of 4884	6724	msedgewebview2.exe	99
PID 6724 wrote to memory of 4884	6724	msedgewebview2.exe	99
PID 6724 wrote to memory of 4884	6724	msedgewebview2.exe	99
PID 6724 wrote to memory of 4884	6724	msedgewebview2.exe	99
PID 6724 wrote to memory of 4884	6724	msedgewebview2.exe	99
PID 6680 wrote to memory of 3360	6680	drop-app.exe	100
PID 3360 wrote to memory of 6856	3360	msedge.exe	101
PID 3360 wrote to memory of 3540	3360	msedge.exe	103
PID 3360 wrote to memory of 1272	3360	msedge.exe	104
PID 3360 wrote to memory of 1272	3360	msedge.exe	104
PID 3360 wrote to memory of 1272	3360	msedge.exe	104
PID 3360 wrote to memory of 4944	3360	msedge.exe	105
PID 3360 wrote to memory of 4944	3360	msedge.exe	105
PID 3360 wrote to memory of 6972	3360	msedge.exe	106
PID 3360 wrote to memory of 6972	3360	msedge.exe	106
PID 3360 wrote to memory of 1304	3360	msedge.exe	107
PID 3360 wrote to memory of 6972	3360	msedge.exe	106
PID 3360 wrote to memory of 1304	3360	msedge.exe	107
PID 3360 wrote to memory of 1304	3360	msedge.exe	107
PID 3360 wrote to memory of 2940	3360	msedge.exe	108
PID 2940 wrote to memory of 1940	2940	msedge.exe	109
PID 2940 wrote to memory of 6624	2940	msedge.exe	110
PID 2940 wrote to memory of 2016	2940	msedge.exe	111
PID 2940 wrote to memory of 2016	2940	msedge.exe	111
PID 2940 wrote to memory of 2016	2940	msedge.exe	111
PID 2940 wrote to memory of 2300	2940	msedge.exe	112
PID 2940 wrote to memory of 2300	2940	msedge.exe	112
PID 2940 wrote to memory of 1480	2940	msedge.exe	117
PID 2940 wrote to memory of 1692	2940	msedge.exe	119
PID 2940 wrote to memory of 6456	2940	msedge.exe	120
PID 2940 wrote to memory of 1852	2940	msedge.exe	121
PID 2940 wrote to memory of 5920	2940	msedge.exe	122
PID 2940 wrote to memory of 5920	2940	msedge.exe	122
PID 2940 wrote to memory of 792	2940	msedge.exe	123
PID 2940 wrote to memory of 792	2940	msedge.exe	123
PID 6724 wrote to memory of 5032	6724	msedgewebview2.exe	124
PID 6724 wrote to memory of 5032	6724	msedgewebview2.exe	124
PID 6724 wrote to memory of 5032	6724	msedgewebview2.exe	124
PID 6724 wrote to memory of 3492	6724	msedgewebview2.exe	125
PID 6724 wrote to memory of 3492	6724	msedgewebview2.exe	125
PID 6724 wrote to memory of 3492	6724	msedgewebview2.exe	125
PID 2940 wrote to memory of 7012	2940	msedge.exe	126
PID 2940 wrote to memory of 7012	2940	msedge.exe	126
PID 2940 wrote to memory of 5484	2940	msedge.exe	127
PID 2940 wrote to memory of 5484	2940	msedge.exe	127
PID 6724 wrote to memory of 3540	6724	msedgewebview2.exe	128
PID 6724 wrote to memory of 3540	6724	msedgewebview2.exe	128
PID 6724 wrote to memory of 3540	6724	msedgewebview2.exe	128
PID 2940 wrote to memory of 7076	2940	msedge.exe	129
PID 2940 wrote to memory of 7076	2940	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\Drop.Desktop.Client_0.4.0_x64-setup.exe
"C:\Users\Admin\AppData\Local\Temp\Drop.Desktop.Client_0.4.0_x64-setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4896

C:\Program Files\Drop Desktop Client\drop-app.exe
"C:\Program Files\Drop Desktop Client\drop-app.exe"
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6680
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=drop-app.exe --webview-exe-version=0.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6680.5108.1605093527660186994 /pfhostedapp:285f8f19bef69f84f8185089ce0ad94ab47a78f2
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView /prefetch:4 /pfhostedapp:285f8f19bef69f84f8185089ce0ad94ab47a78f2 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9507f5fd8,0x7ff9507f5fe4,0x7ff9507f5ff0
    3⤵
    PID:6444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView" --webview-exe-name=drop-app.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1752,i,13591231918390453877,4291469605400704352,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:285f8f19bef69f84f8185089ce0ad94ab47a78f2
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView" --webview-exe-name=drop-app.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2136 --field-trial-handle=1752,i,13591231918390453877,4291469605400704352,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:285f8f19bef69f84f8185089ce0ad94ab47a78f2
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView" --webview-exe-name=drop-app.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1752,i,13591231918390453877,4291469605400704352,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:285f8f19bef69f84f8185089ce0ad94ab47a78f2
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView" --webview-exe-name=drop-app.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3376 --field-trial-handle=1752,i,13591231918390453877,4291469605400704352,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:285f8f19bef69f84f8185089ce0ad94ab47a78f2 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView" --webview-exe-name=drop-app.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2060 --field-trial-handle=1752,i,13591231918390453877,4291469605400704352,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:285f8f19bef69f84f8185089ce0ad94ab47a78f2
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView" --webview-exe-name=drop-app.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=1752,i,13591231918390453877,4291469605400704352,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:285f8f19bef69f84f8185089ce0ad94ab47a78f2
    3⤵
    PID:3492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView" --webview-exe-name=drop-app.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4452 --field-trial-handle=1752,i,13591231918390453877,4291469605400704352,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:285f8f19bef69f84f8185089ce0ad94ab47a78f2
    3⤵
    PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Drop-OSS
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff94de7c188,0x7ff94de7c194,0x7ff94de7c1a0
    3⤵
    PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,3669122038162220409,5140864058528982645,524288 --field-trial-handle=3092,i,6080071164172235737,14678317209487005325,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,1862575443529249441,9441173804739613850,262144 --field-trial-handle=3092,i,6080071164172235737,14678317209487005325,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:2
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,6132991990778111236,6136120160376205539,524288 --field-trial-handle=3092,i,6080071164172235737,14678317209487005325,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:13
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,10055073440095492092,1152840705226169815,2097152 --field-trial-handle=3092,i,6080071164172235737,14678317209487005325,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,12543202278871921555,199891059117737699,2097152 --field-trial-handle=3092,i,6080071164172235737,14678317209487005325,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff94de7c188,0x7ff94de7c194,0x7ff94de7c1a0
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,5024146409151967176,11113702808430131393,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
      4⤵
      System Time Discovery
      PID:6624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,2390539372872371816,5769072278084880350,262144 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,6922741621387253448,5721371443111354359,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:13
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,7778898067408121117,11998533101422452795,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,7778898067408121117,11998533101422452795,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,12842761764880636698,9332155899351923814,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,4168619016623095472,12513900127543822640,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,9678331912322879192,4726389918572528862,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,13306061568085097774,15695537031195137107,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,17170029207606064770,16193545713888659674,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:14
      4⤵
      PID:792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,3941099277613615405,5941950437998294085,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:7012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,10148518575086004396,14198284278413456509,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,2143688675624227199,4482964247325003722,524288 --field-trial-handle=2244,i,7570414610410566035,1726475662411332577,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:7076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

drop-app.exe

Path C:\Program Files\Drop Desktop Client\drop-app.exe
Size 20.0MB
SHA256 a43a584e961f24474a513e2eb153799b61121a9a5985388dad0af21ea6ba32ed
MD5 c69584808da585b5b6e7e56df6d59ff4
SHA1 589aab88d381d31312701dd5747a18c5f48b7404
SHA512 88881e302ce764767e0a8d1cb3a01a88cddd12c83a72d294a31ed3f298ca3e98ef6c201a17b471217ea8be0dd34e97406c70c704a55e0eb49bab94ea955a6ab8
SSDEEP 393216:AJ3COq7DGkN2j41s0YqHqDOiPs5yGsYI:83COq7RUk1saHgDa/
TLSH
T13B27AD43F66291F8C16AC075835A6233FA21BC5947357AEB5BE08B213E69FD0673DB04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f157f7329f2eba924aa0ca39485e6cde2fd8278825380c8456e9bec4022d2733
MD5 59bfb83bc4725eca05ff848ac3c2a4a2
SHA1 4d2623d00f7e4642df9afa30ce06597a532c5453
SHA512 e4c15acf75ae26b73ccdaa3290247d924d3a7f8025a4ef63ad06120f7648380481a6c1a9768e22ffc9e30b047079c9ae0efec32c522718f8316b4789f8905471
TLSH
T199D02321BB387CD7E5281571D031CB007A1A157362B792026650C40C5C7A9E266C76D5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9dfd665d21fd06ac63edc798d5ca686a7ee7922581c64daa0a0c02bd82509afc
MD5 f73989547bed10d3bcfe93a487a283fb
SHA1 97fd1914ef97fcbb15b0194480bfee4bdcfafab3
SHA512 232e534c010d7f0971e82b4a42fa4ac50082894707c85d48e3df09f908f02e152bc3e14b85d5bb9c1710885577dd2ba2c77cfc1f559601934d23b36eb9bce046
TLSH
T1AFF0F9A6D821AC3759FC1B1860554B47EB50132B3B41984B7B3C821C4FB463B4B86C1C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 a7ed65ea47cf43b2e70f6d0cc6a2d820030f301e253fe99be6c7057e587a86f2
MD5 71b71eb0ac642e44541fad933fc5ab19
SHA1 2fda93133d0112f62aca0df1dd9c2ddab252c944
SHA512 cab2977d8cbc9c1525267af958bfcff00fd6056d48ce0c13bf1c3005734bb3730621619777092e32562166783d2f710e7f1b497bcb9752b85a2ca114ce374891
SSDEEP 384:Kio931dmnDHGcmXZfX9CLaSMOkFrgGTf:K+b5adX90aHdrgGTf
TLSH
T14013C53E32664D95FEE7407D112B8B35EF34E8A9C2E552DB47B6321113A0F4248DE64B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 f53f905e199b66cae151a7a8c29187baf901f90d00ff1b8f878bb7f433100a17
MD5 1a31914e60ce7df8367a310a2ce5e529
SHA1 5637efd0b2ac041b8488b9aff84b08b7cdeb6ca2
SHA512 7c426c6ba02fbaae7b9113b7612782682ccc7b71aa730b792d48ac022b5ddb0e497ef8c1a8070fa90000620afb2992d0c35e9ad484ed495fc329c00bd214a899
SSDEEP 1536:8Keh7ML/j/L/WLqeXgbq/gOpD14L/lL/wL/qfRBDE6fsnXbeP4bbfI0EoLGP:8R7ML/DL/CqIg6D14L/lL/wL/p3wA
TLSH
T1A24482F71821600ACFA81AF6D6023A7DD27B414DBCD1EDDDD5390C81A825F32A2F9E59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 95e83aa407396717c01027d3685ccb80331b6d024b5466ad2441dc5c6fd06086
MD5 ba963ae2de0ad39d7a48c8f1ae8a7aa2
SHA1 83e091658873fb8cc1654652bf5f59d86b487335
SHA512 d416613358574897a6ce2f5fc5c84b3020326ac8269ed1ed024a53caf038d191bb18830c8395a005489e490d7075e03ef97a6cc44196937e7da29b4e6aa9863b
SSDEEP 3072:Gv9G+1N4m53H8Jz9Zuz10m8wDko/phNupf7ixVfFcsNGCop/ONBhwDsk8IITO1:GQaum5MJzm1CSlapDKVSsNG1/ONgY
TLSH
T164256AEEC7682C52CF6B8670B0E0E90B7E712183B64CD0D39944C5D997D6B8176E82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 8.0MB
SHA256 e2db48c56a0f531d8e18815b751df6aef99976fc86859db546448e6be30a8c2b
MD5 9ee92f0e9787b73a8896fe6a56516710
SHA1 6654baa582d1950e1b9f1206a9f3065fac1b488c
SHA512 8fbf56fc35c675e1d3bcf78e46ead1db5cc67a4aa4f73981b34c65eef5a33463d0c582758acaaf3b8465cc2decf309102b8932182c2d92b3e910cce1c8ce9a9a
SSDEEP 24576:gGHc1FYTCttzavLZl251EapjJYKwZbn3At/XQUXDAg7/9WKZE4CiKlnitJvFVaQC:p81httzavL6z7pjGTI/XQG/3A7
TLSH
T175869EEDC67458C2CE638930F1E0ED977D7013D3F994C4D68868C58842AB7C6BB9A25E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 174035adf42b57937f6a02463058122c69774702f9ced288a0152be78589466e
MD5 5a3fd174a2f6e476405c8ead31c81e59
SHA1 eb2ad11e15adeebf0c91bde54bbbe852c3dd5264
SHA512 31aa1dc133cb8a33a2d88ff5d3bd2d8a03936f9195b35781a16948c95710e73e5dac45640e4e17308577b536bf5bffbd3654c485a7cefc38fc3c6e713e440646
SSDEEP 48:Cs8baq3IphVvHZQpbuSQdgDLTTTu44ai+feB2MdMaRHO8tum8Xx2GWuP8y:Cs8baqSkPbuOVeYg9u8tlU7P9
TLSH
T103A11831C2718E81FF6068F123E8084BFEF49AC8220B8FC614E4DE718956F6956DD44B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a4c3d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4c3d.TMP
Size 3KB
SHA256 c65600b191cb4cfadb76c04f1477a488a3a26da73fa42f535d0ac557d1e4ab96
MD5 af902827b545ca0dcf548628ff6fc8c5
SHA1 797c90ae3acb17f9b63e87cb102365d49f14e2e4
SHA512 bfcf3df440f399d37574578dcf5461a32d9c8509cda72d38939bedffa7ff34c566d7109a0407a257a9a1529d8bb9af397b18d8f2bd6f4660603f751e3cdc8028
TLSH
T11061E96043B1DED2FB217CB127EC484AFEF59698210B9FC604E46E349902F7956EE04B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 986b804ae268afcb06b8511d1b2c95a11c43bb31d61ac1bbbc7d49f28944af8c
MD5 3618eb57b8f13f13705adb938aa78d2e
SHA1 14c03489e68b93b3486e3149e3c448ba23edbb61
SHA512 e6c0490c509b79925a34b2c2ced95a863531e74d17d2193d0513b53e546cf74b0135cd0dcaaed50f72832148afb9d5f6f97654544945e3725be47931c39992ed
TLSH
T11AE0D8F464C6C22D59A035C381249708F2813842DAC66E4717088CD1BE02007F3E5976
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 6fa7542fe768d164becca6e558b817cef2307f652156584538408ddff58313e7
MD5 750a7e1052a83a754f39be81cf3760de
SHA1 4183c65168a253cb30350a129655fc6e02099b1e
SHA512 a730d22b4fd885d184036b3746ad94df4afff45a921da58a0a073c0237ef9b46df43f880937e7ec28992b1310085c0c58ffe4a14b6e7e17c13721097b9864f61
TLSH
T133E0266414C8C22D99146893876D430CE2E23822E2C83942570EDDA0A91224AE3EE7B4
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 833a99ef8559dd87524dce6800e4a7de3e5a243134f7d6ce1fec09255753fcfe
MD5 55769a82d68870e4328fb3c7faf71a61
SHA1 2b0f817b3c17eb60da3119b8cc41c83a8e9cde5d
SHA512 c1d69575543cad08e3970dbb76a09af8ad26658b0fa9b22a86c4b81970d0b4f89c48cbb3295cf4063b6dd9bb52b5ceacfb18051e02466df71ade853cb3de55e6
SSDEEP 96:UBCx64yl4OJsUYlTCUad2bybsq1pW4EM0j:Ga1yl4tUoTCvIIhEM0j
TLSH
T1BAB209A75E303406CB451E3F12096DB28E3BE26CDFE1EC9570354422EDB899690709FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 899d0ee241a5daf5ae042b3d37982d026bdb9d4be3ff750fc4807a0d733aff4c
MD5 7aa19fc9b39365cae97bdc5d219657e9
SHA1 0882dc55843c5cf4d175b71c8df6d57359a56baa
SHA512 efb03a73aefa6edacafc3694b2ad69817ba21499e7e681b07ffcb4db132b32b99d6d7575583763a57c275fae14b18cb9563a7d582d08345fdeb010fd689b4e76
SSDEEP 96:rrLzQtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/xTbbEOVpZf24JkMfXSFR+CFq:rrLzPH+bF+UI3iWGVoWN3qL/pVVV63
TLSH
T1DD240F4E5F243722CDBD913668E744A35C7DF03F8B1326DA6C6114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 d9e7f479b78f5aed01532f6eea63d99b559e58a27a5d84c833e4ce47d045b047
MD5 5e85e9da4275421a6341db0be2391b72
SHA1 9c70a187941e29e794746d52673c4629018844e5
SHA512 d2a3a547343800f839aa26c792c9b9f88a3ce8c75df94284d06bf101de1be42d69ce5adc75b2e9da14ea74c63f5288c71871714e52f4b61b2b867e1cb1b2a204
TLSH
T160E0D87054CDC21D5904214F435A6708D3A13906E6CD7B825B099C60FC4210CE3DA6F2
MD5 SHA1 SHA512 TLSH

Submit Download

8491cbe0-c63c-45f4-bf65-765b873f63e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8491cbe0-c63c-45f4-bf65-765b873f63e2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 57c53173d5d081af146daef7feec9e118254335fbc8878d5a0ee049be2223edd
MD5 00ff91e276f0fd8e6bcf828cef3ff8b4
SHA1 3405d2a874ff684e938456e680c568e1df90e7c5
SHA512 3b239a5ebedf553852c56837958a3a2f2d34d4e229db3bac67e065b6f3adca6b9fbbdfda7367984ab0e51beb3b40d489228d520f38f1bee92a537872562e4664
SSDEEP 48:TWt/LopFMaty423w/a9NUuTovwLJHN/6GNVbtq7+oPwHuY/JmoZ:6DeMatha9KK6R36u8mm
TLSH
T1E8B2210C2F346221C1B15F7BDDE145952F7C201E93736ADEA85560B2CEB25ABB217076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 57ab5c0eaa3f88426362bf14cf5ce3dec6a5cb2eef56d25e0be6e1be4b4800dd
MD5 1753aed5daf4f51ff7575027afc33b5f
SHA1 df9c54dd136d67d11ffede87942d417c9a9e854b
SHA512 c212e53b858202002b07be09cf2bb0332c6c901e27beba273bff8d2961251b5b5854b486d6e79304bdd3bd5cf0956edf590805e6654560a98000e50fcab9573f
TLSH
T10E517CF787F5956EDA1195F0AA08AE2FCE2C0511831C786AC5E0AE17D3E3871E141B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c469a4f74b4e88824270ddecf9133c6bd61052017879e1a75efc985a474ac4ed
MD5 8a0d244aa3c01dbb0b2fe49c926e5146
SHA1 c26917f0ad3af78cfda349b6426441a0efe3bf6d
SHA512 643afbe471ca89b16f5d37c6ba6c43c219d34f13a76145d7d84820091a5f5110a07d8e728e0f3f208ce6fdd0a7fb4caf46aaced7d7df869c87ed5b3eab2e91be
TLSH
T1C3719CF783F5856D9A0195F0AA18AE2BCE2C0510832C7D6AC9E0AE1BD3E3871E14175F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 3cda48a40aa7462b66eacf040e738db98d9836e23552e8a4773bdf390e7a5c0f
MD5 edcf0422f7397022ea68705e33bd34a6
SHA1 3e7cb648be01bc4aa9bb59e42a979926ff4c5580
SHA512 010755af7782dd5298e6d7a9285464ce751dd0b362f7727bef07c752b157d7ce37eedd3f9382a805aef79ca8af649a7b9e35b05b339c4756af3cb2dfd28f9d35
SSDEEP 96:eIEumQv8m1ccnvS6uK7Ukacf6CnFuJI4g:eIEumQv8m1ccnvS6upw
TLSH
T192F2FCFA07276206D99484B0E4009BCEAF1A001B47B6B7DC76D447E3F7A20E2B5B8756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 df7997b4f91718797bd4225242179398382baab941905c4c9c8408ea57884db0
MD5 e81c7f7bbdf8e2083506f1f9f0148d4c
SHA1 67d77ef82360612517e56edfdf3a454aee91fcfc
SHA512 7c776e8b661c39c0eafc3e99ee6f143046f74d9462aaa8c680961e32b21c092e692f5d09563f1c5206757ba5c2961277e9a36e190bd322925a49e749a3d91883
TLSH
T14E219EF7C9BDB82F1028897B1C457C1A6EBDA43201625CF0DB96A33CE0C29F75A1507A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8a90be173a5fc91597ee4642c4c39425602e1e0818c51cf0ac1e65fec8d89535
MD5 aa8e005a0afba4947795590e03f56dc0
SHA1 17fc1f42f4f6e51dbe2326428fda22900374f62e
SHA512 07aae2e21d3b13365eec93f8e4ddd86bc58f1fc30324bb665d509e1f815bb70ee2b22a2041fed2626c4155b55c9bf694b9b549e33b01234e233e1bb31591e084
SSDEEP 384:sxRddjH/fFsHWvXiN/RIP12/5G/2MrsGQdHjQ2:spNH/fsYXAWU/5c2MrsGQdU2
TLSH
T1E782C806A9288D7B8DDBD21DFA957F53D3F81523A1915E44EAFC8A0C01D66ED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8aec5daafefb83f35638c76b088f1ca19ed398d6a53cbad428febc9db34493a5
MD5 8c0b9b7481d6a8f09de28e578c18aa79
SHA1 ac96ad9d9db5fe9174bac93a4e3d0c74d98f35d9
SHA512 20db593175a37ed5b791b41e0c4a767a1628a2e70c6eff9685791384e6872f43543a307f76af7e3f3d4e87b296d3b9a7bd50d631938305bd4d1362e43a9714ee
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRobbDwzro84N:Ob4YZnE7yTWg1NfwBu1jaCobHwADN
TLSH
T1F1E2EC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA450C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 424f9662dbf6f2fcbc3a621073970e842a69e409614ddea0d5eaf08185188ac8
MD5 9d2287926614bd1f4fc99bf5a5a1a5cd
SHA1 f613b1ae8c382030a6c4618d44afbec5f4602a9f
SHA512 8386dd8e7a1ca7ce98caefb40a5c0e15267a934edc2d95083ea61649572fe2207d5676efe9155b8a92e66e7629d2d73de7bfc02200ae18e12c78496eb5d1c5f5
TLSH
T1D0E0262015C8C27D6016204706258708B2E6B80BD2C83E823F4EC8E0A94398BF2E75B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 c0d30e01d27d8c2b1a699906a2099fbcc4ff586697df91b399f61d98419e3899
MD5 afda2d93bcb6516b3f9ff9a5dc338daa
SHA1 6c34c413b55e28f4fa41fd1d45b78063f79004d5
SHA512 d989a3479b26dbf378a936c497611e55c4093f4da72fdc0030fb55537d83a2a9bfbe25c3432db73eaf42e3ee6a337c00ba9c5686968f45c562646df66cd3ea7d
TLSH
T164E0D87025C9C32E615531874329D308E1E3B803D7CC29612B0DD450B606148B397971
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 1cef41ba2126ad03a254fd64165c7db119911f4b8397d457718427ad7581f328
MD5 f9acbf798684b6daa5d11830076847aa
SHA1 7425a1ef280d179928160b249b1696a6a11872ad
SHA512 6ff89dac6b785518938656ac43137a501c8f2526fda6233fa6d337ec30e61d301e46cf72cb7b1816b7d5f203bd8c1266cb62288cf3c0db96c484ab9068fb06ba
TLSH
T170E086B055C9C33D5404E1CB4679971DA2F1FC0A97C83A96570CC860ED0214AF7FA9B1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9b695b6aaf959160fde30fad04e9f017a2f37ae954503b1b51fcc0085779ac83
MD5 fd78483d1dbdd7ca181592ab2e48f802
SHA1 afb4d5692d7ad66427a94edad5adf2faa3cb89b5
SHA512 ebd901bb28ec48e4e3d0612d6cb99e65a25afbd730acc0aba7a91cb328482858769e4766d60b66e3adca1e1b84dfe067e731cb53899a6f39b6e5f430d5c78df2
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EkRC2kyCtmfyuIwB0ns0X+CJDs8:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRr
TLSH
T1CAB25C51713F4280383EA90C9578981F96C2B4A37519F52F7BA801A65F6BE039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 6f12b457a6f2a1d406500bb78b88f7ee72bc01307850ccc0e5dd3666ad40695b
MD5 830b3dc16fa008ff1f03c13bb2753de8
SHA1 9596cb6ee6c4c4f860cb8f7ac6d29178a69eb28e
SHA512 58a69e020b75dc996cd867f53e681a1070bbba5451f49a2645a0bdfab7b8458fa5dc97030cfd92f16e9dd8d927622b81588c7a1825af6dd8d74ea7cbb4926d9d
SSDEEP 384:DNrRZyCSDnxTIChufXMEhIKyll7svbFKfk7:xFZJSDniXfcyI1l7svbF9
TLSH
T1B244850A7B747001EDE6D9725CB080775E3C716E8F22A6D15DA254694EB3813A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 10KB
SHA256 8df0da52a45ed2d06fd39779f6747ff2fe84425b2382f50c36941a511ca975df
MD5 aa33a1dab169e830c3eea40393b3736e
SHA1 abf0b9115daf1225921d39d4699e4998f50c15fd
SHA512 3fc3ec27f3f1e154b24f2fa3e259ebdab8c866f465ff46d4343958b2b3d482a816da4d545f835890e2e40d1b72c6977826ca3615edb717076302815560ee17ce
SSDEEP 96:cZve89+BFOxZqoQgOX8ZeDWXWY1lD2DseCMAWVtl9wDQHWWVzAhGXI1hBBBBBBB:z1+OCCAstl9wDQ2szAhGXI
TLSH
T16C224196BE435B33E10C89B353B6CF5053E3D48682776A1E76A4345D0ED6A6B87C82F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 322B
SHA256 da10decfde08eec8075b6716d81a82a7fe88d2b3feef1668626f88080c255b3e
MD5 8e4fa5baacca6696549ee1e10ba55c1e
SHA1 20acfab55a75048d67271f731953fe5deecb28a8
SHA512 1e4d33973f6beeb8ffe67036628e13b5f18e50066730fc042e62912a26f3b5af60359fef7ebea284f22b99b5e4250cc8de6ede357b8658f33101a5381b77dc23
TLSH
T17EE02620B8C8C26EA41570D70135830CB2823C13EAD829CA5F0AC4A4EC0110DF7EB5F2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 469021a740c3e31a73c1fd611d419f355a0fc0e63f3abd8cd9b520cea806b30a
MD5 6b2a0337d648809d2cf1df05923304d8
SHA1 490fc676d0cfa71928e8decebbde59eb8e5612c1
SHA512 e75373e61f7adb2a841c2429fc4c0f4396282cc76d76219e1bfe803cb063de8bd69efdc577990727d7d253f1f662ad3456027f4b0a315f53cfd0ea5c594931a3
TLSH
T1B3218C15F320C048E54A867E906B9B350738E8568FBCED0F847920762E71F441E8B7E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 340B
SHA256 14956d056fc3fde211b4406608157c9eb69950ff442fa604ad361ab7664d05e5
MD5 d309a3abe1dcd7d2f42f186d5be9e017
SHA1 8c2e01d10dba6bab39d7a3b75c8ecd230a3210f1
SHA512 59cccbd51ce5553a4f2f66045b5047239bf3d4ae5112cc0bd36b9f861fe1b11c453ff9125d79af14bc3d47891a1a81e49407dba6cf1a08e448505daff67b370c
TLSH
T160E0DFA0B8C8C2AF901160830175D38CA2923D12EAD82E425F0AFC64AE0214AB7AB5B1
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b2e0c42f756b40205eff7e48fbd3ec8afdfeca3948bb4b5f4a610530abcc3b7d
MD5 568597484657b77eb9a883eee423fce4
SHA1 5a9ba4b7d3225f30f4cc438bbeb070f2e1ec8b61
SHA512 fb2a202fd66c2cb1d2162aa9ae974050b32664fa92a018fb192704f55d2a53dc4ee6f20d48e6438e3aecb2a306a9acea90071019895d99bf3cf86134653d3a7b
SSDEEP 3:MsEllllkEthXllkl2zEZlbNtl:/M/xT02zQt
TLSH
T11E4404447FC0040FC5403131C411C37413F0D5500715574334513C135CDD5400C01013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 28adcb0fc5e9b44bc53bb6121ee4e45a92b041eaa8b6a06b80dfc0cd63d84112
MD5 40454e560f643fdec7c36f3ccdadd794
SHA1 443c7eefde3b6480a8863640de83a0a695087935
SHA512 6e0808fef2c5f884444efb1179cd2cf4b8c1f55450880f42183a74f78d1ca7dfcc959f5cd04aee50972a8cfe13bd1d1278f9a421162abb598c758c51e8faeb5d
SSDEEP 3:MsEllllkEthXllkl2zEZlZckhkl:/M/xT02zIO
TLSH
T1C74404147FC0040FC5003531C011D3500370D4100711D7433C5114135CC5D440C05115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c046e29a36f91fc9cafdee6ad73c87dde4d2521eb5a04398d549664fbf657d84
MD5 ded8fe57445cf01f55e1fb798af5eb80
SHA1 2863d12499711b79d5c8fcf1c37b72d727f43ada
SHA512 c4f6ebaa55757a6cce667ee4338a619a4d101aae56ceacfe96004e87962ee75ea4f0a2f1b7997145fbf788b2d22590f0a3df00e0e99cdff8af6607bd34cb8f7c
SSDEEP 384:nfiF1tNn/s3n9Sn8NgH8TUNTUlIRiPvuTujREnf+GGrpNdshPWkLeOObjI9G6w7A:qF1j+9SXHwgUuqAGrfdsje29MA
TLSH
T1AFC25A36E865CEBBEDE64F99B64A7A17EEE01163859C5AC4EAD81D0C00C31ED4703C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 adc802cdded7d0e8a95bc6421401347af48cca90e68344ba216c9bc023b70b69
MD5 18ee141d86296eb8d04903d4d7f854e0
SHA1 f3a7407ae22d1189863fc08ea87cc9231779d902
SHA512 79bc343e91ff66faafd1e3c2feef7f8555cb57d10a746b2749cf26cc7cca57d34e48da440a14beb5fb512f37631bfe1756b0bd4113e852a8b9a899aa27ed1cf3
SSDEEP 768:9FVj+9AQSwgRuehGrfdsvPevzacbD4jG5p:09AQyuBdoCauk65p
TLSH
T19DE2063EDC51CDBF98DE7B88624E6A269AE00173C4B88994E7C41F0C90B759CFB06C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 10cd4045d72ed5f7eb36eb2744a5580351246f8ab24be1d7b7b8ce7dc16dcf36
MD5 7faa4abb3e9b9cbd6899b7ec1923829e
SHA1 88db4358a1ccb1a2c00fb0dd27be389e08c0c22e
SHA512 04783ee0242b79b315c0b6d51a658c090efbc2e0799bf29d0d7b139c67927a2e0851b3393daa2779d786c0daa8a5981d0c70dd20c39b2b9998c03a0e3540de15
SSDEEP 384:ntiFCZcIz8NL08TUNTUlIRMPvuTPB6Enf+GGrpNdshPWOIjzWrKR6m5ZwF7Izo:kFwzQ0wgyuNhGrfdsYPEKR6mS
TLSH
T10BC23A7ADCA4C9BFA8EE6F89660D7A179EE04173C5EC9A98D7C91E0C009319D9306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7d3fc89b52c316fd05d5babf1bab5305246a70dab31b92f520b1c4c916633ca6
MD5 342e4d268dadaf497fc8ecc76764828b
SHA1 5d167621f3c5fa8b4b17ec02019e98d33b83f8d0
SHA512 3e720033770d13aa55fefc7983c33e91f4e397251f923f93c94125df91219efbbb524448e4ec8302a934cccf9a413bcad8f7c1d74634b320225d74a9cf0fb950
SSDEEP 384:nViFCZcIz8NL08TUNTUlIRMPvuTPB6Enf+GGrpNdshPWmBp+FGTVCwF7Izo:cFwzQ0wgyuNhGrfdsvPeCV1
TLSH
T1CBB24B72DCA4CDB7ECEA9F85B64A7653DEE0516385CC9AD4E6C95E0C00872AD070BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ec2c6a791f61f841aa4bab07fa5abb1095dc01ae0c2abddf96a395b8880b1178
MD5 16d736022092f470dd4d59a7ece8b312
SHA1 52d55a7eecc25c59211b67919f94cb3241ba0b7a
SHA512 2101e4c4c935491f1371b2aad0fdb36ea8535985873357b2c1338952dfab5144c560125153b7f5780c51c211c107fd0ec0b5d7e27d12ccde6c4b959c7096db83
SSDEEP 384:nWiFCZcIz8NL08TUNTUlIRMPvuTPB6Enf+GGrpNdshPWmBp+FGTVCwF7Izo:9FwzQ0wgyuNhGrfdsvPeCV1
TLSH
T12BB24B72DCA4CDB7ECEA9F85B64A7653DEE0516385CC9AD4E6C85E0C00872AD070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7a13ec73da899a4df74808d1f8b1ceec2738645e3139e6d355758ae1713ad79c
MD5 8ec96d1268077dae446eb90071603679
SHA1 d7826fb5861f4813a3fd8144f7e61c834b8a9c5e
SHA512 71b179a88a360edcec2aeda3173e54bd8c259b55bd25b53058f0221209492c3dcedbec904bb19a1405df73d4fd80a8d4bbe6145e36cc925a15ba0eb345cc4fb8
SSDEEP 3:MsEllllkEthXllkl2zEflPR:/M/xT02zo
TLSH
T1404404047FC01C0DC50051704455C35017F0D430053557C334D10C335CC7D40CC40101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b203cb02efd00bc9fa84fcfb8fab8fad0b63c361f7ffd1459af2cba083ac5cf2
MD5 2320fe475968f5b849a7ececa7efa48f
SHA1 39a5669fd9d88816a0ff342f46a23b2ccd89f09a
SHA512 b320184805281d5a54a2ca280bd60930b0fbcca6f743e6aabfce817ceead11a3ddbaed73952c304db35e974cbeb846b40427f3cc42ad5792d56cd66502fc6d48
TLSH
T1434132D05C392AC1D4FE0E6F745B29FC94E8C726F4A4343D2858E99855BE65E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

2b2d75b4-5e63-43e0-8641-c840d50dda28.tmp

Path C:\Users\Admin\AppData\Local\Temp\2b2d75b4-5e63-43e0-8641-c840d50dda28.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc559A.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc559A.tmp\UserInfo.dll
Size 4KB
SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
MD5 e6f30908abfc6f53b7c3c36daec4586d
SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
TLSH
T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsc559A.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc559A.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsc559A.tmp\nsis_tauri_utils.dll
Size 33KB
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ec1fb210e93eec6dfb473474ee06158f8c6bf325087963691fca493f338565be
MD5 0b482201070248c7abade56639c11882
SHA1 45fe5f1e91064dcb35be67f1da70bd75463184e4
SHA512 32cd83eecd867f240300ee97914915d0c41e0f8bc779ecedef94a1dbfab78cbec78d0f1fccb5020d6852d69a296d7255dc215b6f182e0473f3155074f11a80e1
TLSH
T123D004145351C100CD1F10F10031C11135D74C1105011501C010445D3DC00504505445
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8100c578944e88a26b439d9c908bb6e76ee13df5c30eba56fa6db8dc6488ec5d
MD5 a7bac248ec65bced199022e6710b7eb0
SHA1 511bcd20b33ad4c9e580135512ea1fa61a28316e
SHA512 919a006ebfb84f1657f2ad1021a1fcdb547499886c4a11c91d3773b335debc5d87087666396e6fb887e4bd833f54c0e8728e1e731023b7248a13791f94aa8bb4
TLSH
T189D0121633528234CC2920B30013A1092882C51B41054001D428C96E3F440A00E06882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 cac3354c18495ff8ccbb8620c58e6d7f8acc30f44391fabffd4a799613ddfcf0
MD5 dbaa3f5f6508d66922347c1b3c7d2800
SHA1 0a74051e0cdb220e44fba9d16e7900d37966fbbd
SHA512 8970c51ad97c98d3e642827bdac1fdb54688a5635cc807208760c9d3af3545a22cafc7592a54f37478b7daa72c8cc8048a036eeb104dfdf431e50feefdcc7162
TLSH
T1F1C092F09D1060BAF310437079E091E0737C69E946278CE294AD89B88CB37CB8EE3000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 41a53b457e18676f7521db29fb792e5dc571cd2d43b240370d15417b252c60ea
MD5 66a6df8f57547cee7ffdf8937eef0e53
SHA1 74733c26b3c087ded79106f86ee37ba8c8cc1166
SHA512 1c26a85050b1b47ec021462f728e68550fdcc173f83d4c0a7c3552ec39d5b30061182c1e128afd83da0cb5b5d3a8a869c57a4d6e58959e1f7958087c324d09ee
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5b51e5.TMP

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Default\Network\Network Persistent State~RFe5b51e5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ead600ee-78cb-4ba9-9252-3658f26cf4dd.tmp

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Default\ead600ee-78cb-4ba9-9252-3658f26cf4dd.tmp
Size 6KB
SHA256 54f6759e78d794bd18e18a2b44c9ba93ca367872de2e192d00e0f49012ecd892
MD5 51d634c9e6eff283c3afdd835cc4e679
SHA1 37b69c18fe433d3754dfe5d2a1baeb25bcf67c24
SHA512 87a8a4d02ef65093ed0135c07f5b92baa30f54ff41643febbb98ab6d2f73d5c5fea1c83b539afa2c36bdc9c36a095127677bba8430c8af533bda92942d4f8a3d
SSDEEP 96:sto/dpO2ab9ikSo5h16Z03Ys7/x+6MhmuecJ3wIjs1ejeNK+gsws8D28XM1C7K:stM33Von3YsV+Fd3wIjsQjriwPG6K
TLSH
T110D1B4066E2869BB4CC6E20DBA397B03E3F9647275911E58E7F8865C05DB6CC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Local State
Size 2KB
SHA256 1a5d94c3061276a0bfc7fdc33bfa6a3c60d9d92fc07331ae9be70b919a28cf6a
MD5 149ff7ec279929cbdb8f562f59529ef8
SHA1 bb6bb8c4ab2105fcfc86730ecffddd44a217dd7b
SHA512 03911c2993d63715484b3a0177a5d67382f0dc421a489d22f92f8e97eda896f2b74d4ca929ec99116dc69d5220dbe8f7c96d7e6858e93691b8cb1dd672f243ab
TLSH
T1285174737858AB7789E39A58B94F2B279F3440A1DA922F2096DD0B0C02CA95D6301C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Local State
Size 3KB
SHA256 1e6edc2c1b1bf29c27e60f31ad28d239ea33fb087686eb723069402a78553941
MD5 1004e57f28b8daedad5b3d42aeaf1a1c
SHA1 85c8b011715f58f7b10da84f6aa0993e480bb52c
SHA512 6a6aad8ffb0f015f69c7729a1780f8e6a486473dd856f855455727f65f458f7172f070afc12dc1613fb11fabf6518a7923e61ff03ce071d5fcb9bfd120089b5e
TLSH
T1DA61873B6878AA778DF3DA08B98A2B17AB644073D5D13F64D6EC0F0C02DB6881341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Local State
Size 15KB
SHA256 dee75821a4252ed8723e49c2bf1bf5a8005742ca33fb5a631e9f480532a8b430
MD5 b017d7d556ecb2030415033278539f4d
SHA1 a4119ea2b737afa95e36736b7b5b25e3389491c5
SHA512 5dd0598b1fa9144a5fff1659abc8a381e73db407f37a97fd4a12d2cab96d2959abfa96bfd4f89d36b6b597ec5ae98cb71b99cd77490aa7af0eceff3a6ccb49a1
SSDEEP 384:f+aQikB+z/xvxjg/qhEmNBS48taxH/isd2B9zm:u/UxvxjgC+W3B/is4Fm
TLSH
T1EB729E3B587D3E3396F3EA05794E075BDBB888B295C26EB44AAD5F0D07C72D80342916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a2a7c.TMP

Path C:\Users\Admin\AppData\Local\org.droposs.client\EBWebView\Local State~RFe5a2a7c.TMP
Size 1KB
SHA256 5c1d5e94719d4f1a14718fa50af4096ef034461a5a536de513ac9510f1cfbe2a
MD5 062783d38e18fe38c1be1a46fc974182
SHA1 f17bb1385f64eee4e4b14fc024583034ef70657f
SHA512 49068c0cedeeede8153d051d52fdc5aea56bc355a23e772e97481f08742b27656e3a9a5f88327a239a2612f19f3c2351df8377c5bb2e5b01483fa840c33e5545
TLSH
T1592165B7A4A85FB3EC93A659714B2B6B1F2040A682914F0062DD4B4D03DA44DE726C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4884-145-0x00007FF972AD0000-0x00007FF972AD1000-memory.dmp

Download

memory/5032-989-0x00007FF971570000-0x00007FF971571000-memory.dmp

Download

memory/5032-988-0x00007FF972730000-0x00007FF972731000-memory.dmp

Download

memory/5932-83-0x00007FF972AD0000-0x00007FF972AD1000-memory.dmp

Download