hxxps://mods[.]to/147x6a6188045f6a5

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mods.to/147x6a6188045f6a5
Sample260802-pyvy8atape

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1252	FC26.exe
4304	FC26.exe

Loads dropped DLL 6 IoCs

pid	Process
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4632	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301482970935465"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{E11EE551-D848-4DB9-8D8F-E97D6658B5FB}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{E10FE61F-3DA1-437B-9F67-2C9B1919482D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	FC26.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	FC26.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	FC26.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
1252	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe
4304	FC26.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3044	OpenWith.exe
4864	OpenWith.exe
2912	OpenWith.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4608	7zG.exe
Token: 35	4608	7zG.exe
Token: SeSecurityPrivilege	4608	7zG.exe
Token: SeSecurityPrivilege	4608	7zG.exe
Token: SeIncBasePriorityPrivilege	1252	FC26.exe
Token: SeIncBasePriorityPrivilege	4304	FC26.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4608	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
3044	OpenWith.exe
3044	OpenWith.exe
3044	OpenWith.exe
3044	OpenWith.exe
3044	OpenWith.exe
4864	OpenWith.exe
4864	OpenWith.exe
4864	OpenWith.exe
4864	OpenWith.exe
4864	OpenWith.exe
4864	OpenWith.exe
4864	OpenWith.exe
4864	OpenWith.exe
4864	OpenWith.exe
4864	OpenWith.exe
4864	OpenWith.exe
4580	AcroRd32.exe
4580	AcroRd32.exe
4580	AcroRd32.exe
4580	AcroRd32.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe
2912	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4804	4340	msedge.exe	86
PID 4340 wrote to memory of 4632	4340	msedge.exe	87
PID 4340 wrote to memory of 456	4340	msedge.exe	88
PID 4340 wrote to memory of 3500	4340	msedge.exe	89
PID 4340 wrote to memory of 456	4340	msedge.exe	88
PID 4340 wrote to memory of 456	4340	msedge.exe	88
PID 4340 wrote to memory of 3500	4340	msedge.exe	89
PID 4340 wrote to memory of 2176	4340	msedge.exe	90
PID 4340 wrote to memory of 1568	4340	msedge.exe	91
PID 4340 wrote to memory of 2176	4340	msedge.exe	90
PID 4340 wrote to memory of 2176	4340	msedge.exe	90
PID 4340 wrote to memory of 1568	4340	msedge.exe	91
PID 4340 wrote to memory of 1568	4340	msedge.exe	91
PID 4340 wrote to memory of 1356	4340	msedge.exe	93
PID 4340 wrote to memory of 2812	4340	msedge.exe	94
PID 4340 wrote to memory of 1356	4340	msedge.exe	93
PID 4340 wrote to memory of 1356	4340	msedge.exe	93
PID 4340 wrote to memory of 2812	4340	msedge.exe	94
PID 4340 wrote to memory of 2812	4340	msedge.exe	94
PID 4340 wrote to memory of 1480	4340	msedge.exe	99
PID 4340 wrote to memory of 1336	4340	msedge.exe	100
PID 4340 wrote to memory of 1480	4340	msedge.exe	99
PID 4340 wrote to memory of 1336	4340	msedge.exe	100
PID 4340 wrote to memory of 3680	4340	msedge.exe	101
PID 4340 wrote to memory of 3680	4340	msedge.exe	101
PID 4340 wrote to memory of 3680	4340	msedge.exe	101
PID 4340 wrote to memory of 4648	4340	msedge.exe	102
PID 4340 wrote to memory of 4648	4340	msedge.exe	102
PID 4340 wrote to memory of 4648	4340	msedge.exe	102
PID 4340 wrote to memory of 3148	4340	msedge.exe	103
PID 4340 wrote to memory of 3148	4340	msedge.exe	103
PID 4340 wrote to memory of 3148	4340	msedge.exe	103
PID 4340 wrote to memory of 3312	4340	msedge.exe	105
PID 4340 wrote to memory of 772	4340	msedge.exe	106
PID 4340 wrote to memory of 772	4340	msedge.exe	106
PID 4340 wrote to memory of 772	4340	msedge.exe	106
PID 4340 wrote to memory of 1040	4340	msedge.exe	107
PID 4340 wrote to memory of 1040	4340	msedge.exe	107
PID 4340 wrote to memory of 1040	4340	msedge.exe	107
PID 4340 wrote to memory of 4252	4340	msedge.exe	108
PID 4340 wrote to memory of 4252	4340	msedge.exe	108
PID 4340 wrote to memory of 4252	4340	msedge.exe	108
PID 4340 wrote to memory of 4764	4340	msedge.exe	109
PID 4340 wrote to memory of 4764	4340	msedge.exe	109
PID 4340 wrote to memory of 4764	4340	msedge.exe	109
PID 4340 wrote to memory of 1280	4340	msedge.exe	110
PID 4340 wrote to memory of 1280	4340	msedge.exe	110
PID 4340 wrote to memory of 1280	4340	msedge.exe	110
PID 4340 wrote to memory of 1900	4340	msedge.exe	111
PID 4340 wrote to memory of 1900	4340	msedge.exe	111
PID 4340 wrote to memory of 1900	4340	msedge.exe	111
PID 4340 wrote to memory of 4036	4340	msedge.exe	112
PID 4340 wrote to memory of 4036	4340	msedge.exe	112
PID 4340 wrote to memory of 4036	4340	msedge.exe	112
PID 4340 wrote to memory of 4408	4340	msedge.exe	113
PID 4340 wrote to memory of 4408	4340	msedge.exe	113
PID 4340 wrote to memory of 4408	4340	msedge.exe	113
PID 4340 wrote to memory of 4124	4340	msedge.exe	114
PID 4340 wrote to memory of 4124	4340	msedge.exe	114
PID 4340 wrote to memory of 4124	4340	msedge.exe	114
PID 4340 wrote to memory of 4316	4340	msedge.exe	115
PID 4340 wrote to memory of 4316	4340	msedge.exe	115
PID 4340 wrote to memory of 2020	4340	msedge.exe	116
PID 4340 wrote to memory of 2440	4340	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mods.to/147x6a6188045f6a5
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffbbd4fc188,0x7ffbbd4fc194,0x7ffbbd4fc1a0
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,6868176434838185620,7010208174945942577,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,11191008928099750546,11298313697604283416,262144 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,13365973614406568567,10639486941067134196,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,14702748354990744234,13456767493791903222,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6273646553654439368,4093105611540772115,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,3653767897493337246,13570904839084540265,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,12995362554442445335,2408173752029600065,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,18045091030764888597,16593552032376042125,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,5414592641984623871,7223251603317118986,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5496,i,4143303907681368887,14564916386070286463,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5868,i,2359806033582650120,7716853417033347389,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6008,i,6941436789993027946,8338687588638512911,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3561115520404394370,4803257901815660360,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3561115520404394370,4803257901815660360,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6932,i,11618923828893383570,13289920459734225080,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6828,i,13763429212274609647,16793638623519323073,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7088,i,11113026923456949437,418182350616268883,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7228,i,12631695267360612523,11671608201863624205,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7468,i,4454743242391209902,10519222778953147265,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7584,i,13650647166263748354,14640324707983880178,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7764,i,14409787647013635287,10448658682329222489,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7056,i,12907245001751877984,9213314628970892857,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7040,i,5170162941815723643,16994068841045696791,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,5300575924450374780,8048963572651351021,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,2713293200215414879,16678718798630056318,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,3515538548385897836,14978552791497682991,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,7806459146853697733,10082882684131492726,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,4127497376288719633,16000941273773497785,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6092,i,4878305494409486701,13347928299930026966,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7672,i,8802600367958515026,5826319874069873126,2097152 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7648,i,17759958975501922022,11840385255703270837,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7956,i,11327086116682279659,13679712007183012147,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,7203037218156195619,2841580974396334204,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,12352259548961642296,2353767574153284334,524288 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=7952 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5176,i,4097823553632730111,2210637492681761531,262144 --field-trial-handle=2396,i,17594265669745259548,13282483277736233199,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2240

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\" -spe -an -ai#7zMap24470:102:7zEvent10588
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4864
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\eaac_bypass.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4580
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4128
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=72C219F4C2446E9A40A1D8265BC3B710 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2884
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8526ED0BF9230A30531A6C5BAA50B641 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8526ED0BF9230A30531A6C5BAA50B641 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:3044
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0E4B9B08A327F0A977D636028423B550 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:1264
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EF12C3723EF9AE134381868314B83671 --mojo-platform-channel-handle=1812 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2484
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7BF292450E11D4F836F8998900AECF5E --mojo-platform-channel-handle=2384 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2784

C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\FC26.exe
"C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\FC26.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\FC26.exe
"C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\FC26.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2912
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\anadius.cfg
  2⤵
  PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16425677_sc.dlf

Path C:\ProgramData\Electronic Arts\EA Services\License\16425677_sc.dlf
Size 401B
SHA256 ebdb304177b94c20fe60f5fa4859838cd9fc1ddd2731d493e3160b8eca86d988
MD5 7d60f96dd25f8f43422cd03099393b12
SHA1 008d1099868aaa279806072ab0fb8af7447d5cdf
SHA512 c8e5ba429df85189bbcc667db2e6e2de0dc2b30b73b330670b041bb8c52e173cbd2d10c00c339c818927f7683197d6abeafd76d4e257fd00af93326997bfc09a
TLSH
T173E02860E7030A20F40069F132B3F7A15E04FEB8F721763E421164E308D7A17460F80E
MD5 SHA1 SHA512 TLSH

Submit Download

FC26_16425677_sc_OnlineActivation_Log.html

Path C:\ProgramData\Origin\Logs\FC26_16425677_sc_OnlineActivation_Log.html
Size 7KB
SHA256 29208a93509bd784ab6e1e5efd537085491ae099d17e2ced003f9e1197a0adf9
MD5 f5084d2c33eae5f070281a12b6fecad3
SHA1 45a58841d7787818b1107af60f95c23de3f63c62
SHA512 426e23ad63de48ef71d72d5e6bf76bf5cd2c2fcbff520d292e0b14223b985fe44f8ab5e9260e79ae804e6476170c33c45afac434d9787742cada6b241381a997
SSDEEP 192:KftpH94zTCl2CGu3L2HvGzAmc02HvGzAmcI:KftpH98Ol2CGu72HiAmc02HiAmcI
TLSH
T198F1585337FA414DB1F2AA8EAC7354421A3BFD1D2874C59D11AC850E4FB3B11A862B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600
Size 1KB
SHA256 24fad6dea25eb5e107e6f814091a88e30a140a612884bc62fb848c8afb4c1a21
MD5 0bd301bccb760a723720ea345be75fcf
SHA1 382980eed97f79bed3d0173583210eb644ff0a8e
SHA512 127c07e2ecc1a0e5ccb2078b3d868728f8d36de80ad93a5a5b10b8bcc743005ebb43b9fbd9689d93dd85d78d109f5f60cc12d6b43860cd4450190150b9780c5b
TLSH
T18231E7938726FC43B880CE402196E376399C67B86ADF09813170C5A74A833F15F4D809
MD5 SHA1 SHA512 TLSH

Submit Download

229169D96B9C20761B929D428962A0A2_E724097EF7BBA8B1CB3228AA4D2ED312

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_E724097EF7BBA8B1CB3228AA4D2ED312
Size 1KB
SHA256 c5d269f1d20f7b924a2d2f5bc639fd814e0f2d86ec151e8bf5fa7fd16ed65cca
MD5 589cf83c68fa499253ee30be040c99cf
SHA1 f47856be80b2c5ee81fd80ba13054f373a8ffe4a
SHA512 4e836daee1c0f68bb14a6064c3d278dc7e48f5dee1accf1a48b2b3949f346846f478b3426a67e59f96d2affb7e0eb9ca183e630f57f0ac0ac7efe0e7e823e594
TLSH
T17131C7C4A53F74217BC359ED16CEDE331C7092D059D0244B38AE31D4CA84F92062682D
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_D2697B2B8BEDB774E81A42AE85A5DAD5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D2697B2B8BEDB774E81A42AE85A5DAD5
Size 727B
SHA256 a62705972785c14a529dec7e20e1fc99693c08849ca7152d9f03eac42ff7ddc7
MD5 8891c64696ea6105a151f2ac77d59e92
SHA1 e5f23949fd08abaf100582a952a65e01d4ca7171
SHA512 8d13ff4a4cf0c89d4134221b694b8afcd09e6bc5d1ddf7922f20b8eab44bfa6acab065d30c9b67f803502f72489fd5b2bbc9ebb2e80d12bac0867c795ac7da34
TLSH
T11D0199095EFFD088281244063159C1B7774C41413C4E49BA923F6004D88927D3DD611D
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 e737524b4374c9dbaeaf53f139cc82c9f670b9dd145c0be92efcbfb85ae0125a
MD5 d7b91b9471036ece56c0fa0535145ee2
SHA1 6fd274db5edafdc7ecac3893676dc0625ab92380
SHA512 2f1511a8b2205ae71aa7a66aa58f57d0209918f50129b5c5bf24343ff83faa480376b93bcc457e741b84f5ca566c82b35349df719aef4c7095259d643a0f848d
TLSH
T1EB0165875D5007513C91D5968AA964643836B28825D012BB33A120DF1A687A4ADCBC0D
MD5 SHA1 SHA512 TLSH

Submit Download

F2E248BEDDBB2D85122423C41028BFD4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4
Size 1KB
SHA256 552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
MD5 78f2fcaa601f2fb4ebc937ba532e7549
SHA1 ddfb16cd4931c973a2037d3fc83a4d7d775d05e4
SHA512 bcad73a7a5afb7120549dd54ba1f15c551ae24c7181f008392065d1ed006e6fa4fa5a60538d52461b15a12f5292049e929cffde15cc400dec9cdfca0b36a68dd
TLSH
T14421C64312603C088B17DCFFB915C9BA65BA7D96AC22C870424ED9D017B97CF54AE06C
MD5 SHA1 SHA512 TLSH

Submit Download

1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600
Size 388B
SHA256 9a015a5c5662abfcab58beeb6338889afcf5564c30aaf05b0785a541f679664f
MD5 95251d2282fe2d217235d53695191d16
SHA1 c2dbdefba3264e6a5dc4750db3948110062f7156
SHA512 e2e8bb87389a8923ae7a26d4cfd6fc4e4090ae7b6b2629d79ab0558f2ac8dcda2977bf6e8da23867200605a2da914ceced2a527cb5321e95f20a9c3d12aa60f8
TLSH
T186E026102AFE5256E435DD794AC6BB755E2CB22B981593F60EB06362BA49A00EC33830
MD5 SHA1 SHA512 TLSH

Submit Download

229169D96B9C20761B929D428962A0A2_E724097EF7BBA8B1CB3228AA4D2ED312

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\229169D96B9C20761B929D428962A0A2_E724097EF7BBA8B1CB3228AA4D2ED312
Size 420B
SHA256 021705d4acffb7622f8a531bf2796666a1be00bc65e26dbec099f2174b860df8
MD5 9c6c230971e727924f309a4f9b56c221
SHA1 662b724b218db7e632a50feed6b10f7abbc005d7
SHA512 17e8b0311dfc15ccf22188c8ad91dbda39b4375b65f4c41fe1345ce9b1aaa4c025aaba7d2c61c2ad2127346af6cd9128750b6baa9c1cab41a93165bf398f3aaf
TLSH
T1A5E0680455FB006DE431FABC86CBD2768D69F132841157B92A7095196F42E00CC22B34
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_D2697B2B8BEDB774E81A42AE85A5DAD5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D2697B2B8BEDB774E81A42AE85A5DAD5
Size 404B
SHA256 1fb64d94680da6880ed249f5df373d89102bdccafbeee9df85422be3de65a871
MD5 4eb0e1f73eda4bf8e7e40268f7d1c50e
SHA1 83dc2a03f170009c83af44e4e1c6fb62a193e512
SHA512 5bddbd271a040676cdb468bf44d555ced32edda114231711cc86785e10dc3213e4504b9fee6c2f919f3e3064c0d1f8f70bb37000922696afd5fc9c0525971658
TLSH
T1CEE0C030F1F6008DF0F4B4B446F75C1258AAF10F08428656067012065721B404CD1530
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 7287f65ab7a9e5e8b514376153e77b20ce23f405db9ada918f81b7899df3b643
MD5 7d112f3eb5b666637300dfac0c24984a
SHA1 da299b70b6ca9719f75f838dbbf536009fc133d9
SHA512 41ffb539752d9a90ab64849a97ab82df259b17f397489d1ceb4956cb0a42c69962ad79ba90a040697096ed7c4aa7f347c3255fefcf95c6c6ec07e8a7530f8efc
TLSH
T1DDE0262C6AABA11EF090DC3546F9B1761D89E301204496B901D19308B70AF005C50AF0
MD5 SHA1 SHA512 TLSH

Submit Download

F2E248BEDDBB2D85122423C41028BFD4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4
Size 254B
SHA256 14d4778e86a0466335387bbb218ec236e879d66921b116b9ac7ef69965dd208a
MD5 cd39730a35c74b3bb7ab0ac8ec12f911
SHA1 b28effc6fb016993bff81b744c30dd38c4bbe18c
SHA512 bc7b0574f80dbae1ec85a2e04b8cfc845f81ba69ebcd71bd75ea080d60901f42ac029a5bca184a1c7a01cec8663235d907f1b4ed362c17cca394abe025b53397
TLSH
T157D08C20ABF58343F3B51A3E997A5240EC30FA99A842CF0842F515CE2831F409C71E2F
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 88b16d3840dc1dc65205285943eab8668887984c4333d1f2b353b948b778ff2c
MD5 42c96a13171d9e6ad6fe7993cbd5bb44
SHA1 cb6a4734a53456b81ac15fea372389c35b8569ad
SHA512 c611a3b3cf2043d2c5ff63619a7e27ff0ef29a0d5d7430320aa5964efbdcdffe8246ee821e2b68aabfd3578561207a1f6e8e32a92f2317dbd2c0c4863d10aed3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7D:fwUQC5VwBIiElEd2K57P7D
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 34KB
SHA256 4b4f47452f420002647661b492c932a9b4c82dd4585d92570ca38ef6f59f49a2
MD5 037e43c4f88c4d4997f484f3e6ee51e7
SHA1 614f50a4a32a074897c5c99b96bdbc7a8a74ccd5
SHA512 f136e54b24555329728fbf22054687e91dd60ae85ee9c82304aee67acfbf6ca68c81e9bcb5840d82fa93580c2d54e8a8f09177ae7c188caa81281aca0082421b
SSDEEP 768:KwrfkFvPyRz1zU11Bktn90ClY5v8zQGINmheVPABa/oXJ8NXZEe:KwzgvPyr6ytHY5CymheuBa/oXq/Ee
TLSH
T111F20113ABE97A393F2D05D918B2D2E9699F1DCF44DF52E5C04297A8C1101B00DB0DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 28ad2a77b7c666af0e08c4c9091024159321c17effa72a70568883a67208554c
MD5 88aaacc762df57341d02bb5d00fb92c2
SHA1 82ba67d98684f8b1d1c9bba68310a21a47fa95b0
SHA512 d0dbfda0a1c9cd23d626815c25fe66e371a9cb4c19c55f6db24842197d5364ca7aee1959e84d844f39b070fca54d813589a07586b918dc32ebc755a3cd2f4135
SSDEEP 96:8EwnLw1qmmQENiLWA8VvLIHTzdGP1+THd7EYvy:HFFzLWzSX4P0Hd7EWy
TLSH
T10DA1A32716E73466F760C130D4C60A27FD728CA8795F4EA94CDC2C32F90F7968312898
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe596e41.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596e41.TMP
Size 3KB
SHA256 4cc46416573ed2ac7db4b982154a872fc98ab4c327711e4386a0ad4e7b73df28
MD5 cfc36e167baec7b3abcb485c8ed3b349
SHA1 eb4394bca384a8c4854245c975ca82cd97c3947f
SHA512 183725e9c96dbce44f4109eb78ecc04568e2ae4153dc17a0128a0d68eddea7f209c1a9da3346ab0284dfb9aab449be822f791fd9188e93c5bdcc343ffa43be9a
TLSH
T15261D52909F534B8F761C23095D21637FD718CBCB95F9E5104EC6C72FA0EB290756908
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 23KB
SHA256 a7061117cff26947e23c2e75d14c5c7e46804587472cc68e6d915efba0bc799d
MD5 b3d40b63572d459727f1a3f20be0b1bd
SHA1 6f50fe4cf8663bbf43fd5e000af026f211375098
SHA512 26d122c495f41647e725d70f4cebffa0925c008dcaaab87ab2457b6f731aa2e16e6424621f2600aee12c36b8b7349f43e82f7cec781f776320c29a27808dea46
SSDEEP 384:Dy04ySf4e7wDesJSIleQ+Z8czJAieVuJkBeDTqlwVRQiGGt0r7MQPKJw8Cf6BaKr:eNWAsL9+0wJ446Le0E
TLSH
T1A9B269F7C7F846BDC91152F4AA242F1FCF19099A03683C0A99D5EE0BA7A2571F14294F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f90ee35e3152214f1f7aa3cee55c956436299c641ef3599aa257f0c8a0b2aa55
MD5 4ecaddd4b42bc981312223e41e95c795
SHA1 2acc42369267777b79b46324f562f5e8ee4f3e51
SHA512 f82534dddf2d467962f753ca939f5f80448ca99eb278988dd27a2eff6f83d9cab0edc2f948c056074b1d03ea7c9ee57dfcc4850a75a37a372cdcd52c351fc350
SSDEEP 192:sxZ2aRhyM/jK1Ml8Mk//fWxsS61Idp5l8HW6+WNDUKY/YHzLptIgrJ:sxZ2avM//fWxsS6GQHbG/q9
TLSH
T1B352D7116A34A97BCCCBD209FA45BF53D6F90472E2901E44A9FCDA1C00E6EED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e7101da03e50d42e9dad942daae412c1268ad0f108cb439a3c6bf4349ef4b20b
MD5 3cb4081ef4c9f6f338e4c995be48fd6f
SHA1 9324ac7873d550ec83aa07064b1c63c46e429062
SHA512 1482aa5d29c49de44a0857a7014fba3ad8517a31cd49b5d96dac8d6a7e616b0cfd33625198eeec765f3de4d3870ff878ae1440364a614942f7a11fb31631e9b3
SSDEEP 192:sxZ2aRhyM/jK1Ml8UQy9//fWxstrGIdpjldHW6+WNDUX8XYHFbwtIg5kJ:sxZ2avqE//fWxstrnfHbzXfa
TLSH
T1E852D611AA34A977CCCBD60DB945BF93D6F50472A6900E54AAFCDA1C00E7EED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 758ac8789e47741e2723cf170712828fe61423925ee6fdb616d91425e9d5afa2
MD5 1cb40b6181b69db88ffb7f0d7ec7d65e
SHA1 ef7af37d21540e15b5937fa91f818536a8d01080
SHA512 6f89724405ff39c717f588c1ebee5f6d545dc96f53f2c086a1e96435c20b22f81ecb0eb735a3c04eeef2bcef8a4f180587eb82fa814cff8355fb488ae2cd53f1
SSDEEP 192:sxZ2aRhyM/jK1Ml8M9//fWxstrGIdp5ldHW6+WNDUX8XYHZpptIg5kJ:sxZ2av1//fWxstrnBHbzXEa
TLSH
T1F652D711AA34A977CCCBD60DFA45BF53D6F50472A2900E54AAFCDA1C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ed7eaa51e865077ce9ea8dd69a72e0e4e03553997e617d5597d74da855c4f2fd
MD5 239f1021984d869f8e4d007aac7a75c7
SHA1 1c64647d9a7d08848373fb23855bb1362743e389
SHA512 9affe3ce1245c65b3220f3222b122f0e18f899e40ad14d1a11e631461ccb90a720bf61af6fa6d8b922741f62f59ea8ccd372e84c984d9dc0b99e3fa5e89bed4e
SSDEEP 768:ShUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RBroVf0H:ShUZYTMWvg09ou1ja7eLZmR6uH
TLSH
T1C8E20A2F280CCB7E4F844E5DEC2AAF963ED801CB6A584D5447EA894C03C76EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 32b5123f8087dc5d132daa630d3fc6766b7d76fbb53ebc72995c3f1393daab40
MD5 a6c44e980a3c32f36ee9a282cfb6f854
SHA1 0dbfacbef10555cd04cf31a4d1127df88a7fcbfa
SHA512 76a9bd322a53f6201705ce4cdfba462453c8f6a9926f046f111c95b5f949972a1bda6147cb4ff2ab34a410e783f10f05d6289a19dc9e1d94cb1d02ff01b48d45
TLSH
T157A0026412C2E641C1100272AEC5015933185810131A965259D808C48E5A2874545711
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 9c7fbf4c0a5caec4c4f16128fde8c0f4234f6b6b4635ed023d1e33c5b08b7121
MD5 cf32e60ac4357161053f7d0362950a7a
SHA1 5216638dd01f576529dc2c8eca4f175a22d697e9
SHA512 a051316487d85bce904e594c035c9c7635f9163eac4aa469ee2dd25eac86d146051f5771ff9038a0a145f27ee92b94e37d7dddf527fc524b80fbf0e0df1e1788
SSDEEP 96:KA1eK2A8e8KziWa+EKLqUy8K7iSiKkKf6w:EWDXgfnX
TLSH
T104D1075270BAD2513D7F2B088794C75A8E8173633418E52B7BAC40B65E27E249CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ca7b9b48-da50-4096-b47d-767ce2f3d9cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ca7b9b48-da50-4096-b47d-767ce2f3d9cb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 32097a50a0408ba9ea8a7247dee073a2373e1bfd8399a945e319897fbf7bfda1
MD5 129154caf6ee68acacc2a06a145b1572
SHA1 ce1e4b48171875dacb511a0e00ab56551bc536f9
SHA512 040aaa31e09fa2b08086237ce467d7b82b781e2ad299902ff583bdf1007a3ea2e9086eb8f7add8ecb1d95d3c5300c322acc7f397b238cea84b31853e29b4504e
SSDEEP 384:biFqZcIxCsNs8TUNTUlIllo1UTSzX5od+s8YxiXpRnTKwBODNZOCa5/:2FI4bwgkmmOlapRnewBKZOZ/
TLSH
T13BD229F258DB9836DDAEAB47A73D2D024EBCC067F5846A50B3985A0CCC565BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b32c6b72f17a63b16b5d1284ab426dfab03216f7521c8c9efbd12852431588c2
MD5 6b70f7fa8532ffe0e71b4d42e3e310f7
SHA1 a18ee0c6f4e5f22906e0ffa203124dba35cfb341
SHA512 ee3fe950bb192f832218a6b0a12deb3c655d3cdee289fb1ada36213139dda57df3dec771393c0180e902d597a83b376d837d77d1f339fbe89592e37692efb8c8
SSDEEP 384:biFqZcIxnsNz8TUNTUlIllo1ITSzX5od+s8YxiXJRnTKwBODNZOCa5/:2FIVSwgkamOlaJRnewBKZOZ/
TLSH
T1F6D219F258DB9836DDAEAB47A73D2D024EBCC067B5806A50B39C5A1CCC565BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7787f73195fa8e43f1807a41d95ca0f2ad32da562fd60576a9fa0a465c2c0116
MD5 b93be131b454330b345c9446bfb7e8ec
SHA1 fe0ee1c4f475b2b0ca3396a6e5e17d9fc19f250a
SHA512 ab60da8dc4cc58e1ce507cb01b84066ea344dc325a49ec22fe0654526092ad1aae5df5f3fcaa5ba4eae0de434566b14f98465c0ac2af669500f704d91a6212ac
SSDEEP 192:yONn61VWQmiUytbgGX5Obd+jgjzorYyRNF/a73PmU6:yONn6WogGX5od+s8YBTmU6
TLSH
T18C02C736A8687CBB8EE3AE49B44737135FD4106BEA956F80D6EC1F1C009765C2346937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 7d68d17a5b077c73c1427e4e39c6a2fe6ab6d639355f8305cafe83a2dc70ee4b
MD5 f393340e65c2c0abdea39c992603ead3
SHA1 dbe9e5d8fae0c2dceaedff9f6d173fd1403df627
SHA512 5c55423fa702f727f70f7f969ce0fe53f2797247433bbb31ca547b91b1cf8161d2338f6c125c7aa585f7b47c6971866004435d770bbcb41da68bef81d7c50e71
SSDEEP 384:WZcIhsNhBo1MtSzX5od+s8YxiXdRnTKwBODNZOCa5/:EhNkmOladRnewBKZOZ/
TLSH
T17E927E72A82C6C775EE7B545B84A32034EF89067E7D52F94D6EC6F1C009A9A8130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 95d7ec814b46707087a14a613583ae836368ff6ad0fbe6ace751d8faf52ce9a4
MD5 a2de165df6a50e6e16791581ecb91993
SHA1 b7b449eaf3fdae79b29d47b3971bc7bdf0dee8da
SHA512 31f7bd6c984c6498491e186a7645128c7e9d7b403454db133add3185748c0fc72d0d3c9eddef7390221fa4d6891bad82ec65af67d21fe8761a5b927983a2a09e
SSDEEP 384:3ZcIhsNhUo1MtSzX5od+s8YxiXdRnTKwBODNZOCa5/:/h2kmOladRnewBKZOZ/
TLSH
T1D2927D32A83C6C775EE7B545B84A32034EF89167E7D52F94D5EC6F1C009A9A8130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f0de325b6be3da29a47ee0e1ef7721de48f868883fbf3394169084cf769090bc
MD5 e04f36bbedd47d8b873a0a7a66e4c4a5
SHA1 04e537cd6f4f536364860658a41f08ef39bcd9bd
SHA512 f20a483c887b55fce677c5da68df175d45ceeea4501bfbe008daf6f686f3d7129a69f0f91dc3984fe4168a19a3fd5fafd75cfabc9660bf180f9ba86bf6c71c44
SSDEEP 384:biFiZcIxzsNz8TUNTUlIlBo1MTSzX5od+s8YxiXTRnTKwBODNZOCa5/:2FQBSwgUOmOlaTRnewBKZOZ/
TLSH
T11ED218F258DB9836DDAEAB47A73D2D024EBCC067F5806A50B3985A1CCC565BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e153bdaf-97b6-40a7-be8b-a595e420031f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e153bdaf-97b6-40a7-be8b-a595e420031f.tmp
Size 8KB
SHA256 048e3355ef905f82da154f709943cd89c2e0db6e0c3f7beb8d35ba5fb6fe0072
MD5 5d427da1233a50b4d984776934995a10
SHA1 f9cc7f8f693363990c144ef1f3fa80427cd16f85
SHA512 7fc942db0c718279719cb518416ce462279de102564c55730c257ad0292a458310e27e1ab5b42b41662bf120b8edc50bcd1fa2129ba71a6da5c5a7bb9d156387
SSDEEP 192:yONU61fWQmiUykbOGX5Obd+jgjzorYyRNMiX1UjJtqyLU6:yONU6kPOGX5od+s8YxiX6RU6
TLSH
T16912F932A468AC6B5ED3B955B44B32135EE5512BEB857F80D2EC2F1C00DB9AC131BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc986d79-421b-4228-8c4e-75b03ae41a22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bc986d79-421b-4228-8c4e-75b03ae41a22.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 54f5f2c83ee5498b163b3f2023698a39c3363065c206c0a338a361843e810713
MD5 23e5ac5f8beb41cf4b7c20883c10f620
SHA1 2245b130efcedd7c03ee67100c6d6ead9b9fe82d
SHA512 2fa38e1eeddd38e83108c40d46a85dd0e4b4a2a65e79225a5d89d672517eb66d50d830b5e7da3e2f06b878c713b3deff042bfc19e676da2b32d2cb10ff2dc4d1
TLSH
T1E8412759BAF91148B3B26E5A9BF6A86D847F78331F06C09E10110E4F0623B41C8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

anadius.png

Path C:\Users\Admin\AppData\Local\anadius\LSX emu\anadius.png
Size 7KB
SHA256 833d5a6444b352bec759221e1973d7045b88967f4507059c6ffd95aa15cf34dd
MD5 703e8faa22ebd3ecf5f316f72eff9c2d
SHA1 4c61f2f292f5e0eb2956f944aa322efe4f027438
SHA512 9356f2ae5b47b5d3b3a565bc554abd271e0cc1431e10a6d240f3c80c75866aed2c54a39db336c673ff9ca50b1ff89d9460b6ed58e133aa2a24c71dd34ca91062
SSDEEP 192:FspAJb5s0SLWyWLFH3YDmaOagkCEtsVevCnQqCKRP4:2mu0AWLFH3YvOzkhtsVeqnQIm
TLSH
T12DF18F2C3151A558C9E0D3B81E531E637B1F3F269A2E7B9262643C589409F8C6B1DD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.png

Path C:\Users\Admin\AppData\Local\anadius\LSX emu\default.png
Size 3KB
SHA256 9584cb4afe2734f4b30f0fe30d8390e76dd8703ac603fcf4a13c8f2df11133f5
MD5 ea6243b4f61fc358ea140dfdf830ef22
SHA1 e6a7d94d9e094cef5ea7f5c9489f93b6d3d17c23
SHA512 049b699d83ee4b4e35a9d59d9c1355b071642698073b9f2f5b91e5aed4c54a3cabd64625001c221f2a6e21c5f555114162988be6a1918f2ba0016ad98e94dcd5
TLSH
T114815C90E1A04BFC7173E4034B14C345863EE42D018BFB2DAC3539202AD4FABD26A977
MD5 SHA1 SHA512 TLSH

Submit Download

Activation64.dll

Path C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\KZ26\Activation64.dll
Size 2.9MB
SHA256 9ec7757f3ed9e647ce22f30f0800038ede7adae5760bf8b670f4cf5fb7493fe8
MD5 77907393fa79cb20ca148c7ce7e9a7ae
SHA1 348b7b9250fac7c4e63f305b3131638e1fec51d9
SHA512 fed84546fb003144db48cee61c0011a44be0cdc39b679cd84c08b032990c96d0c8df86d4d37dfab69059d8caff9a37650b954c1b8693c22dc70b70ae5c67f507
SSDEEP 24576:+FAA5UsZjLRQ6tesMGKEuf01KywqsUXqPGQNzt4WYjm:AA4U4FvfbwBNNRcm
TLSH
T113E54A42BAFE51D8E8FBE33481765227B8753C598730EBDF824015564F623D0A9BEB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

anadius.cfg

Path C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\anadius.cfg
Size 984B
SHA256 8447ee49566e953b7fd637ef162a1b0f1874eac08de41bf1844e182c1104cd30
MD5 bd66cb28be8d956092d81aea12e732f2
SHA1 9d3e100ca09fe9c019ccb7332f539532429bc86f
SHA512 5d233c4ac75c82eb5a022a6b8d7be1122766fd44e4cf5dfa655c759cdc51c333d009b06eb0cf015e7f044239c333b3901e3c12c71a69bdda0dc553f1c5921c97
TLSH
T118118571D4850C21337D8376A5311A07F8410BBB26418904778DB92E9F7C31382E1AEE
MD5 SHA1 SHA512 TLSH

Submit Download

anadius64.dll

Path C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\anadius64.dll
Size 678KB
SHA256 9e420c3aae5ea26410f0bf578f86c47e51e36ff770b9e2a28b5eaee46aed786c
MD5 587b6e7f8401a3a61fccea5e78dad599
SHA1 9bd77479dc51f500da6ae95246365d952493637d
SHA512 edd69608861821ebd7b31976de761c882adf5e5e984d8178e39931f4057e30fd0d10ae29a5919cc24ae3ce578428fee02a207d987c2242bc5ee4a4bb6060f312
SSDEEP 12288:dQLlsaVfh16n69rlIs7aq84E2utMW29i2+TR:OSa1WkHE2utMP
TLSH
T1E1E47D6A77A401BCD17BD179CD974912E7B278060361ABCF03E046AB6F1BBE05A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaac_bypass.dll

Path C:\Users\Admin\Downloads\Showcase NAC TU 1.6.5\eaac_bypass.dll
Size 141KB
SHA256 0e2874721867a0ca4d01a94b62badd39ceb2ad086cf45aea71a584f654427ed4
MD5 57384e8981947cedd50139acc87d26f8
SHA1 1bea3a4867ee211685489b8621cea94deb38d23d
SHA512 846fc1d8afb4c6bfabb0cc2e80a6178919f04c97b89d8b6093075b693b10420ae6835a0092c80eaa30058a8558bd639a6b8591fe36a57d00c04c724e99f7aae3
SSDEEP 3072:QjU1MP2YKn0WGwwP1DWMhcSBSonBxN6Ugb9MQ:YOdZGLoiSoKmQ
TLSH
T139E36C57B3A910BBE1779138C9630A06E772781507219BEF13A4437A2F273D19E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-628-0x0000000002200000-0x00000000022A9000-memory.dmp

Download

memory/4304-621-0x0000000140000000-0x0000000141000000-memory.dmp

Download

memory/4304-627-0x0000000002160000-0x0000000002209000-memory.dmp

Download